InfoSecBulletin Cybersecurity for mankind
Proof of concept exploits for a serious SQLi vulnerability in Fortinet FortiWeb have been released, allowing pre-authenticated remote code execution on vulnerable servers.
FortiWeb is a web application firewall (WAF) that protects web applications from harmful HTTP traffic and threats.
Ransomware Crisis in 2026: 5,064 Organizations Affected in 135 Countries
Palo Alto Networks Addresses 13 Vulnerabilities
Critical Dell BIOS & Zimbra Flaws Expose Enterprise Systems
CoLoCity Launches New 1.0 MW Data Center Facility at Gulshan
Daily Cyber security update for 10. 07. 2026
How Hacker Compromise AWS Cloud Environment Using AI in 72 Hours
Mycelium Framework: First AI-as-a-Service Botnet
CrowdStrike Shows 5 New Prompt Injection Techniques for AI Agents
Critical GCP Dialogflow Vulnerability Allows Malicious Code Injection
CIRT identified 153 publicly exposed FortiGate devices in Bangladesh
The FortiWeb vulnerability, rated 9.8/10 in severity, is identified as CVE-2025-25257. Fortinet resolved it last week in versions 7.6.4, 7.4.8, 7.2.11, and 7.0.11 and later.
“An improper neutralization of special elements used in an SQL command (‘SQL Injection’) vulnerability [CWE-89] in FortiWeb may allow an unauthenticated attacker to execute unauthorized SQL code or commands via crafted HTTP or HTTPs requests,” reads Fortinet’s advisory.
The vulnerability was identified by Kentaro Kawane of GMO Cybersecurity, who recently revealed a static hardcoded password issue in Cisco ISE just last month.
FortiWeb pre-auth SQLi to pre-auth RCE:
Cybersecurity firm WatchTowr and a researcher named “faulty *ptrrr” shared detailed guides and example exploits that allow for remote access.
The flaw was discovered in FortiWeb’s Fabric Connector, which syncs authentication and policy data among Fortinet products.
The software contains an unauthenticated SQL injection flaw in the get_fabric_user_by_token() function, which uses the following code to issue a MySQL query:
snprintf(s, 0x400u, “select id from fabric_user.user_table where token=’%s'”, a1);
This code did not properly sanitize the bearer token sent in HTTP request headers, allowing attackers to inject custom SQL into the header to achieve SQLi.
Attackers can trigger the flaw through HTTP requests to the /api/fabric/device/status endpoint by injecting SQL into the Authorization header (e.g., Bearer AAAAAA’or’1’=’1), allowing attackers to bypass authentication checks.
The researchers were able to escalate the SQL injection to remote code execution by executing MySQL’s SELECT … INTO OUTFILE query via the SQLi flaw to create arbitrary files on the device. This allowed them to write a Python .pth file into the site‑packages directory.
As .pth files are automatically loaded and run when Python is executed, the researchers found a legitimate FortiWeb CGI Python script (/cgi-bin/ml‑draw.py) that could be used to launch the malicious code in the .pth file and achieve remote code execution.
With exploits now public, admins should prioritize installing patches to protect their servers.
Source: Watchtowerlab
