InfoSecBulletin Cybersecurity for mankind
Proof of concept exploits for a serious SQLi vulnerability in Fortinet FortiWeb have been released, allowing pre-authenticated remote code execution on vulnerable servers.
FortiWeb is a web application firewall (WAF) that protects web applications from harmful HTTP traffic and threats.
Researchers show new technique to bypass AI safety guardrails in Grok and Gemini
About thousands of leaked AWS keys Held Full Admin Rights
US Bank investigates LockBit’s Data Breach Claims
Five new malware families actively targeting Asian Gov.t infra
T-Mobile Cuts Cables to Remove Chiness Salt Typhoon Hackers from Network
Splunk, Zyxel Patch Multiple Flaws Enabling RCE and Root Command Execution
“Zombie Card” attack revels expired Visa card may be used for contactless payments
Critical Zimbra RCE Flaw Actively Exploited in the Wild
Operation CameraSwarm
A single hacker compromise 1400+ Dahua camera worldwide
Cl0p Ransomware Listed 40+ Victims of PTC Windchill Campaign
The FortiWeb vulnerability, rated 9.8/10 in severity, is identified as CVE-2025-25257. Fortinet resolved it last week in versions 7.6.4, 7.4.8, 7.2.11, and 7.0.11 and later.
“An improper neutralization of special elements used in an SQL command (‘SQL Injection’) vulnerability [CWE-89] in FortiWeb may allow an unauthenticated attacker to execute unauthorized SQL code or commands via crafted HTTP or HTTPs requests,” reads Fortinet’s advisory.
The vulnerability was identified by Kentaro Kawane of GMO Cybersecurity, who recently revealed a static hardcoded password issue in Cisco ISE just last month.
FortiWeb pre-auth SQLi to pre-auth RCE:
Cybersecurity firm WatchTowr and a researcher named “faulty *ptrrr” shared detailed guides and example exploits that allow for remote access.
The flaw was discovered in FortiWeb’s Fabric Connector, which syncs authentication and policy data among Fortinet products.
The software contains an unauthenticated SQL injection flaw in the get_fabric_user_by_token() function, which uses the following code to issue a MySQL query:
snprintf(s, 0x400u, “select id from fabric_user.user_table where token=’%s'”, a1);
This code did not properly sanitize the bearer token sent in HTTP request headers, allowing attackers to inject custom SQL into the header to achieve SQLi.
Attackers can trigger the flaw through HTTP requests to the /api/fabric/device/status endpoint by injecting SQL into the Authorization header (e.g., Bearer AAAAAA’or’1’=’1), allowing attackers to bypass authentication checks.
The researchers were able to escalate the SQL injection to remote code execution by executing MySQL’s SELECT … INTO OUTFILE query via the SQLi flaw to create arbitrary files on the device. This allowed them to write a Python .pth file into the site‑packages directory.
As .pth files are automatically loaded and run when Python is executed, the researchers found a legitimate FortiWeb CGI Python script (/cgi-bin/ml‑draw.py) that could be used to launch the malicious code in the .pth file and achieve remote code execution.
With exploits now public, admins should prioritize installing patches to protect their servers.
Source: Watchtowerlab
