InfoSecBulletin Cybersecurity for mankind
Proof of concept exploits for a serious SQLi vulnerability in Fortinet FortiWeb have been released, allowing pre-authenticated remote code execution on vulnerable servers.
FortiWeb is a web application firewall (WAF) that protects web applications from harmful HTTP traffic and threats.
Daily Cyber security update for 26.10. 2026
The Washington Post report
Ex-DOGE AI startup Cathedral Breaches Anthropic Internal Systems within 12 Hours
Daily Cyber security update for 25. 10. 2026
Daily Cyber security update for 24. 10. 2026
PHP shares new RCE flaw (CVE 2026-115560) with no patch but mitigation
US banks faced unauthorized access by AI agents in customer accounts: Axios reports
Atlassian patched 176 flaw in Jira and Confluence: Fortinet Urges to Patch Flaws Affecting FortiOS, FortiManager
Hacker claim to access Rajasthan Police data: 70,000 records allegedly exposed
Update now! PHP2Shell: Critical PHP vulnerabilities patched
Trump says data centres should pay dividends to local community
The FortiWeb vulnerability, rated 9.8/10 in severity, is identified as CVE-2025-25257. Fortinet resolved it last week in versions 7.6.4, 7.4.8, 7.2.11, and 7.0.11 and later.
“An improper neutralization of special elements used in an SQL command (‘SQL Injection’) vulnerability [CWE-89] in FortiWeb may allow an unauthenticated attacker to execute unauthorized SQL code or commands via crafted HTTP or HTTPs requests,” reads Fortinet’s advisory.
The vulnerability was identified by Kentaro Kawane of GMO Cybersecurity, who recently revealed a static hardcoded password issue in Cisco ISE just last month.
FortiWeb pre-auth SQLi to pre-auth RCE:
Cybersecurity firm WatchTowr and a researcher named “faulty *ptrrr” shared detailed guides and example exploits that allow for remote access.
The flaw was discovered in FortiWeb’s Fabric Connector, which syncs authentication and policy data among Fortinet products.
The software contains an unauthenticated SQL injection flaw in the get_fabric_user_by_token() function, which uses the following code to issue a MySQL query:
snprintf(s, 0x400u, “select id from fabric_user.user_table where token=’%s'”, a1);
This code did not properly sanitize the bearer token sent in HTTP request headers, allowing attackers to inject custom SQL into the header to achieve SQLi.
Attackers can trigger the flaw through HTTP requests to the /api/fabric/device/status endpoint by injecting SQL into the Authorization header (e.g., Bearer AAAAAA’or’1’=’1), allowing attackers to bypass authentication checks.
The researchers were able to escalate the SQL injection to remote code execution by executing MySQL’s SELECT … INTO OUTFILE query via the SQLi flaw to create arbitrary files on the device. This allowed them to write a Python .pth file into the site‑packages directory.
As .pth files are automatically loaded and run when Python is executed, the researchers found a legitimate FortiWeb CGI Python script (/cgi-bin/ml‑draw.py) that could be used to launch the malicious code in the .pth file and achieve remote code execution.
With exploits now public, admins should prioritize installing patches to protect their servers.
Source: Watchtowerlab
