InfoSecBulletin Cybersecurity for mankind
Proof of concept exploits for a serious SQLi vulnerability in Fortinet FortiWeb have been released, allowing pre-authenticated remote code execution on vulnerable servers.
FortiWeb is a web application firewall (WAF) that protects web applications from harmful HTTP traffic and threats.
India’s Tata Electronics hit by cyber breach: Hacker target 630 GB record
Anthropic’s Mythos reportedly broke NSA classified systems in hours
OpenAI New Method “Deployment Simulation” Predicts AI Risks Before Deployment
AryStinger botnet infected thousands of D-Link routers globally
Hacker suspected of sending alerts across Brazil
CyberSentinel AI features 33 security tools like Nmap, SQLMap, and ZAP, utilizing Claude and GPT
Barracuda hosts Dhaka roundtable on cyber resilience
CISA Alerts Fortinet Users as FortiBleed Affects 86,644 FortiGate Devices
CISA: Splunk flaw under active exploit, patch by Sunday
Texas data breach exposes 3 million driver’s licenses
The FortiWeb vulnerability, rated 9.8/10 in severity, is identified as CVE-2025-25257. Fortinet resolved it last week in versions 7.6.4, 7.4.8, 7.2.11, and 7.0.11 and later.
“An improper neutralization of special elements used in an SQL command (‘SQL Injection’) vulnerability [CWE-89] in FortiWeb may allow an unauthenticated attacker to execute unauthorized SQL code or commands via crafted HTTP or HTTPs requests,” reads Fortinet’s advisory.
The vulnerability was identified by Kentaro Kawane of GMO Cybersecurity, who recently revealed a static hardcoded password issue in Cisco ISE just last month.
FortiWeb pre-auth SQLi to pre-auth RCE:
Cybersecurity firm WatchTowr and a researcher named “faulty *ptrrr” shared detailed guides and example exploits that allow for remote access.
The flaw was discovered in FortiWeb’s Fabric Connector, which syncs authentication and policy data among Fortinet products.
The software contains an unauthenticated SQL injection flaw in the get_fabric_user_by_token() function, which uses the following code to issue a MySQL query:
snprintf(s, 0x400u, “select id from fabric_user.user_table where token=’%s'”, a1);
This code did not properly sanitize the bearer token sent in HTTP request headers, allowing attackers to inject custom SQL into the header to achieve SQLi.
Attackers can trigger the flaw through HTTP requests to the /api/fabric/device/status endpoint by injecting SQL into the Authorization header (e.g., Bearer AAAAAA’or’1’=’1), allowing attackers to bypass authentication checks.
The researchers were able to escalate the SQL injection to remote code execution by executing MySQL’s SELECT … INTO OUTFILE query via the SQLi flaw to create arbitrary files on the device. This allowed them to write a Python .pth file into the site‑packages directory.
As .pth files are automatically loaded and run when Python is executed, the researchers found a legitimate FortiWeb CGI Python script (/cgi-bin/ml‑draw.py) that could be used to launch the malicious code in the .pth file and achieve remote code execution.
With exploits now public, admins should prioritize installing patches to protect their servers.
Source: Watchtowerlab
