InfoSecBulletin Cybersecurity for mankind
Proof of concept exploits for a serious SQLi vulnerability in Fortinet FortiWeb have been released, allowing pre-authenticated remote code execution on vulnerable servers.
FortiWeb is a web application firewall (WAF) that protects web applications from harmful HTTP traffic and threats.
Citrix NetScaler SAML 0-Day Flaw Under Attack
Major Danish university breached, 200,000 users at risk
Microsoft’s X account hijacked to promote Clippy crypto scam
Critical cPanel, GitLab AI Gateway and Dell CSM Flaws Enable RCE And Admin Hijacking
Nearly 100,000 email addresses exposed in first AI-related data breach in Singapore
Hackers Exploit Zimbra Mail Servers: TeamViewer patched 5 critical flaws
Google Warns of Hackers Actively Exploiting Citrix 0-Day Flaws
CISA Warns Critical MikroTik RouterOS Flaw While Cisco SD-WAN Zero-Day Exploited in Attacks
Apple Zero-Day Exploited: Pentagon Data Breach Reportedly Exposes Sensitive Data of 3 Million People
JadePuffer Agentic AI targets and destroys Azure’s cloud resources
The FortiWeb vulnerability, rated 9.8/10 in severity, is identified as CVE-2025-25257. Fortinet resolved it last week in versions 7.6.4, 7.4.8, 7.2.11, and 7.0.11 and later.
“An improper neutralization of special elements used in an SQL command (‘SQL Injection’) vulnerability [CWE-89] in FortiWeb may allow an unauthenticated attacker to execute unauthorized SQL code or commands via crafted HTTP or HTTPs requests,” reads Fortinet’s advisory.
The vulnerability was identified by Kentaro Kawane of GMO Cybersecurity, who recently revealed a static hardcoded password issue in Cisco ISE just last month.
FortiWeb pre-auth SQLi to pre-auth RCE:
Cybersecurity firm WatchTowr and a researcher named “faulty *ptrrr” shared detailed guides and example exploits that allow for remote access.
The flaw was discovered in FortiWeb’s Fabric Connector, which syncs authentication and policy data among Fortinet products.
The software contains an unauthenticated SQL injection flaw in the get_fabric_user_by_token() function, which uses the following code to issue a MySQL query:
snprintf(s, 0x400u, “select id from fabric_user.user_table where token=’%s'”, a1);
This code did not properly sanitize the bearer token sent in HTTP request headers, allowing attackers to inject custom SQL into the header to achieve SQLi.
Attackers can trigger the flaw through HTTP requests to the /api/fabric/device/status endpoint by injecting SQL into the Authorization header (e.g., Bearer AAAAAA’or’1’=’1), allowing attackers to bypass authentication checks.
The researchers were able to escalate the SQL injection to remote code execution by executing MySQL’s SELECT … INTO OUTFILE query via the SQLi flaw to create arbitrary files on the device. This allowed them to write a Python .pth file into the site‑packages directory.
As .pth files are automatically loaded and run when Python is executed, the researchers found a legitimate FortiWeb CGI Python script (/cgi-bin/ml‑draw.py) that could be used to launch the malicious code in the .pth file and achieve remote code execution.
With exploits now public, admins should prioritize installing patches to protect their servers.
Source: Watchtowerlab
