CVE-2025-25257 - FortiWeb Pre-Auth SQL Injection to RCE

07/09/2025 by TheStingR

Disclaimer: This proof-of-concept (PoC) is provided for authorized security testing and research purposes only. Unauthorized use against systems you do not own or have explicit permission to test is illegal. Users are responsible for complying with all applicable laws and regulations.

CVE-2025-25257 is a critical vulnerability in Fortinet FortiWeb, a web application firewall, within its Fabric Connector component. It allows attackers to execute arbitrary system commands without authentication, posing a severe risk of full system compromise.

Affected Versions

Vulnerability Overview

This vulnerability stems from insecure handling of the Authorization: Bearer <token> HTTP header in the get_fabric_user_by_token() function. Due to insufficient input sanitization, attackers can inject malicious SQL commands (SQL Injection, CWE-89).

Impact:

• Authentication Bypass: Attackers can execute arbitrary SQL queries without credentials.
• Remote Code Execution (RCE): Using MySQL's SELECT ... INTO OUTFILE, attackers can write malicious files (e.g., webshells or Python scripts) to the server, enabling full system control.

Download

📥 Download Latest Release (v1.0.0)

Files included:

• CVE-2025-25257.py - Python exploit script
• README.md - Complete documentation
• exploit_workflow.svg - Attack workflow diagram

Exploit Workflow

The exploit follows these steps, as illustrated in the Mermaid diagram below (rendered natively on GitHub) and the static image exploit_workflow.svg:

graph TD
    A[Attacker] --> B[Target Endpoint]
    B --> C[SQL Injection]
    C --> D[Webshell Creation]
    D --> E[Command Execution]
    E --> F[System Compromise]

1. SQL Injection: The attacker sends a crafted HTTP request to the vulnerable /api/fabric/device/status endpoint.
2. File Creation: The SQL injection writes a webshell (e.g., webshell.php) to the server.
3. Command Execution: The attacker sends commands via the User-Agent header to the webshell, executing arbitrary system commands.

Why This Is Critical

• CVSS Score: 9.6–9.8 (Critical)
• Unauthenticated Access: No credentials are required for exploitation.
• Full System Compromise: Attackers can gain complete control of the affected FortiWeb device.
• Active Exploitation: Public proof-of-concept (PoC) exploits are available and being used in the wild.

Remediation

References:

• Fortinet PSIRT Advisory (Check for FG-IR-25-XXX when published)
• Community write-ups: Exploit-DB, HackerOne

PoC Usage (Authorized Testing Only)

This tool is for authorized security testing and research purposes only. Ensure you have explicit permission to test the target system.

Prerequisites

• Python 3.8 or later
• Required libraries: requests, argparse
• Install dependencies: pip install requests

Usage

python3 cve_2025_25257.py -t https://target-ip

Post-Exploitation: After successful exploitation, the script outputs the webshell URL (e.g., https://target-ip/webshell.php). Commands can be sent to the webshell via the User-Agent header using tools like curl or a browser.

Example

python3 cve_2025_25257.py -t https://192.168.1.100 --proxy http://127.0.0.1:8080

Output: If successful, the script will display:

[+] Webshell deployed at: https://192.168.1.100/webshell.php
[+] Send commands via User-Agent header, e.g., `curl -A "whoami" https://192.168.1.100/webshell.php`

Summary

CVE-2025-25257 is a severe, easily exploitable vulnerability in FortiWeb, enabling unauthenticated attackers to achieve full system control. Immediate patching is critical, and organizations should monitor for signs of exploitation.

Visual Aids: The Mermaid diagram above renders natively on GitHub. The static exploit_workflow.svg (included in the repository) provides the same workflow for offline viewing or presentations, with scalable vector graphics for high-quality rendering.