
A working (at least for me :] ) exploit for CVE-2025-25257
Exploits for CVE-2025-25257 released by watchtowr and others I found on github did not work on my installations of fortiweb downloaded from the official vendor website. I ripped some of these exploit codes to make a poc capable to pop a reverse shell on my environment. IP address and port of the reverse shell are hardcoded and must be changed ofc.
Exploit analysis and walkthough have been described in a two-part videos in my youtube channel (ITA language, ENG subtitles):