CVE-2025-25257 - FortiWeb Vulnerability Checker & Exploit

A Python-based tool for checking and exploiting CVE-2025-25257 vulnerability in FortiWeb devices. This vulnerability allows SQL injection and remote code execution through a crafted Authorization header.

📋 Description

CVE-2025-25257 is a critical vulnerability in FortiWeb devices that allows:

• SQL injection via the Authorization header
• Remote code execution through webshell upload
• Unauthorized access to vulnerable systems

🚀 Features

• Automated vulnerability detection for single targets or bulk scanning
• SQL injection exploitation to upload webshells
• Command execution via uploaded webshell
• Bulk target processing from file input
• Results logging with timestamps
• Comprehensive error handling

📦 Requirements

pip install requests urllib3

🛠️ Installation

1. Clone the repository:

git clone https://github.com/yourusername/CVE-2025-25257.git
cd CVE-2025-25257

2. Install dependencies:

pip install -r requirements.txt

📖 Usage

Vulnerability Checker (vuln_check.py)

Check a single target:

python3 vuln_check.py -t https://target.com

Check multiple targets from a file:

python3 vuln_check.py -l target.txt

Command Execution (exp.py)

Execute commands on a vulnerable target:

python3 exp.py -t https://target.com -c "id"

📁 Files

• vuln_check.py - Main vulnerability checker and exploit
• exp.py - Command execution tool for vulnerable targets
• target.txt - Sample list of targets (replace with your own)
• vuln.txt - Output file with vulnerable targets (generated after scan)

🔍 How It Works

1. SQL Injection: Exploits the vulnerable API endpoint /api/fabric/device/status
2. Webshell Upload: Uses SQL injection to write a webshell to /cgi-bin/x.cgi
3. Command Execution: Executes commands via the uploaded webshell
4. Verification: Tests command execution to confirm successful exploitation

📊 Output

The tool generates a vuln.txt file containing:

• Timestamp of each scan
• Vulnerable target URLs
• Command execution results
• Scan statistics

Example output:

# CVE-2025-25257 Vulnerable Targets - 2025-01-27 10:30:15
# Format: [timestamp] target - command_output

[2025-01-27 10:30:15] https://target.com - uid=0(root) gid=0(root) groups=0(root)

credit:0xbigshaq