{"id":"CVE-2025-25257","published":"2025-07-17T16:15:34Z","modified":"2026-06-17T09:00:34Z","title":"Fortinet FortiWeb SQL Injection Vulnerability","vendor":"Fortinet","product":"FortiWeb","tier":"core","eol":null,"description":{"text":"An improper neutralization of special elements used in an SQL command ('SQL Injection') vulnerability [CWE-89] vulnerability in Fortinet FortiWeb 7.6.0 through 7.6.3, FortiWeb 7.4.0 through 7.4.7, FortiWeb 7.2.0 through 7.2.10, FortiWeb 7.0.0 through 7.0.10 allows an unauthenticated attacker to execute unauthorized SQL code or commands via crafted HTTP or HTTPs requests.","provenance":"source","from":"NVD"},"summary":{"text":"The SQL injection flaw (CWE-89) lives in Fortinet FortiWeb, the web application firewall product, across versions 7.0.0 through 7.6.3 as listed in the affected ranges. An unauthenticated attacker with network access to the device can send crafted HTTP or HTTPS requests to execute unauthorized SQL code or commands, requiring no credentials, no user interaction, and no particular configuration.","provenance":"ai","model":"claude-haiku-5-5","generatedAt":"2026-10-31T12:59:16Z"},"cvss":{"score":9.8,"severity":"CRITICAL","version":"3.1","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H","provenance":"source","from":"NVD"},"epss":{"score":0.99921,"percentile":0.99968,"date":"2026-10-30","provenance":"source"},"kev":{"dateAdded":"2025-07-18","dueDate":"2025-08-08","ransomware":false,"requiredAction":"Apply mitigations per vendor instructions, follow applicable BOD 22-01 guidance for cloud services, or discontinue use of the product if mitigations are unavailable.","notes":"https://fortiguard.fortinet.com/psirt/FG-IR-25-151 ; https://nvd.nist.gov/vuln/detail/CVE-2025-25257","provenance":"source"},"vulncheckKev":{"dateAdded":"2025-07-11","exploitedFirstSeen":"2025-07-11","ransomware":false,"evidence":[{"url":"https://app.crowdsec.net/cti/cve-explorer/CVE-2025-25257","date":"2025-07-11"},{"url":"https://dashboard.shadowserver.org/statistics/honeypot/vulnerability/map/?day=2025-07-13&host_type=src&vulnerability=cve-2025-25257","date":"2025-07-13"},{"url":"https://dashboard.shadowserver.org/statistics/honeypot/vulnerability/map/?day=2025-07-14&host_type=src&vulnerability=cve-2025-25257","date":"2025-07-14"},{"url":"https://dashboard.shadowserver.org/statistics/honeypot/vulnerability/map/?day=2025-07-15&host_type=src&vulnerability=cve-2025-25257","date":"2025-07-15"},{"url":"https://dashboard.shadowserver.org/statistics/honeypot/vulnerability/map/?day=2025-07-16&host_type=src&vulnerability=cve-2025-25257","date":"2025-07-16"},{"url":"https://x.com/Shadowserver/status/1945407662805454871","date":"2025-07-16"},{"url":"https://dashboard.shadowserver.org/statistics/honeypot/vulnerability/map/?day=2025-07-17&host_type=src&vulnerability=cve-2025-25257","date":"2025-07-17"},{"url":"https://dashboard.shadowserver.org/statistics/honeypot/vulnerability/map/?day=2025-07-18&host_type=src&vulnerability=cve-2025-25257","date":"2025-07-18"},{"url":"https://fortiguard.fortinet.com/psirt/FG-IR-25-151","date":"2025-07-18"},{"url":"https://www.cisa.gov/sites/default/files/feeds/known_exploited_vulnerabilities.json","date":"2025-07-18"}],"evidenceTotal":323,"provenance":"source"},"exploited":true,"otx":{"pulseCount":50,"pulses":[{"name":"Actively_Exploited_Kev | Oct 30, 2026","url":"https://otx.alienvault.com/pulse/6ae35d889ea92b4ce19c2680","created":"2026-10-29"},{"name":"BREAK THE SILENCE: Tracking Silent Lynx Through Exposed Infrastructure","url":"https://otx.alienvault.com/pulse/6ae2841d3d49c6b5b1e6adaf","created":"2026-10-28"},{"name":"Actively_Exploited_Kev | Oct 29, 2026","url":"https://otx.alienvault.com/pulse/6ae20c1db17e7057ae7d9ad1","created":"2026-10-28"},{"name":"Actively_Exploited_Kev | Oct 28, 2026","url":"https://otx.alienvault.com/pulse/6ae0ba7e0e2a97ff7b218819","created":"2026-10-27"},{"name":"Actively_Exploited_Kev | Oct 27, 2026","url":"https://otx.alienvault.com/pulse/6adf68b85c3e852f3c111d18","created":"2026-10-26"},{"name":"Actively_Exploited_Kev | Oct 24, 2026","url":"https://otx.alienvault.com/pulse/6adb740e397c3ad4799aa4cd","created":"2026-10-23"},{"name":"Actively_Exploited_Kev | Oct 23, 2026","url":"https://otx.alienvault.com/pulse/6ada236fcfba2dfa730ea482","created":"2026-10-22"},{"name":"Actively_Exploited_Kev | Oct 22, 2026","url":"https://otx.alienvault.com/pulse/6ad8d33a077cbb5cab524d80","created":"2026-10-21"},{"name":"Actively_Exploited_Kev | Oct 21, 2026","url":"https://otx.alienvault.com/pulse/6ad78130c4d1ac2be83a8b6d","created":"2026-10-20"},{"name":"Actively_Exploited_Kev | Oct 20, 2026","url":"https://otx.alienvault.com/pulse/6ad62f63c24a405a3423cc13","created":"2026-10-19"}],"provenance":"machine"},"cwes":[{"id":"CWE-89","name":"Improper Neutralization of Special Elements used in an SQL Command"}],"references":[{"url":"https://fortiguard.fortinet.com/psirt/FG-IR-25-151","tags":["Vendor Advisory"]},{"url":"https://packetstorm.news/files/id/210193/","tags":["Exploit","Third Party Advisory","VDB Entry"]},{"url":"https://www.exploit-db.com/exploits/52473","tags":["Exploit","Third Party Advisory","VDB Entry"]},{"url":"https://github.com/0xbigshaq/CVE-2025-25257","tags":["Third Party Advisory"]},{"url":"https://www.cisa.gov/known-exploited-vulnerabilities-catalog?field_cve=CVE-2025-25257","tags":["US Government Resource"]}],"techniques":[{"id":"T1055","name":"Process Injection","tactics":["privilege-escalation","stealth"],"provenance":"source","basis":"ctid-kev","bases":["ctid-kev"],"basisDetail":"CTID Mappings Explorer KEV 07/28/2025 (ATT&CK 16.1); capability: SQL Injection","mappingType":"exploitation_technique","evidence":[],"comment":"Affected versions of FortiWeb contain insufficient input sanitization, allowing for an attacker to use SQL injection to write a malicious .pth file to the into FortiWeb's site-packages Python directory. This allows the malicious code to execute using the privileges granted to Python scripts in that high-level directory.","confidence":"high"},{"id":"T1068","name":"Exploitation for Privilege Escalation","tactics":["privilege-escalation"],"provenance":"source","basis":"ctid-kev","bases":["ctid-kev"],"basisDetail":"CTID Mappings Explorer KEV 07/28/2025 (ATT&CK 16.1); capability: SQL Injection","mappingType":"exploitation_technique","evidence":[],"comment":"Affected versions of FortiWeb contain insufficient input sanitization, allowing for an attacker to use SQL injection to write a malicious .pth file to the into FortiWeb's site-packages Python directory. This allows the malicious code to execute using the privileges granted to Python scripts in that high-level directory. Given the use of SQL, this can lead to potential loss of data within the database.","confidence":"high"},{"id":"T1190","name":"Exploit Public-Facing Application","tactics":["initial-access"],"provenance":"source","basis":"ctid-kev","bases":["ctid-kev"],"basisDetail":"CTID Mappings Explorer KEV 07/28/2025 (ATT&CK 16.1); capability: SQL Injection","mappingType":"exploitation_technique","evidence":[],"comment":"Affected versions of FortiWeb contain insufficient input sanitization, allowing for an attacker to use SQL injection to write a malicious .pth file to the into FortiWeb's site-packages Python directory. This allows the malicious code to execute using the privileges granted to Python scripts in that high-level directory.","confidence":"high"},{"id":"T1059.004","name":"Unix Shell","tactics":["execution"],"provenance":"source","basis":"ctid-kev","bases":["ctid-kev"],"basisDetail":"CTID Mappings Explorer KEV 07/28/2025 (ATT&CK 16.1); capability: SQL Injection","mappingType":"primary_impact","evidence":[],"comment":"Affected versions of FortiWeb contain insufficient input sanitization, allowing for an attacker to use SQL injection to write a malicious .pth file to the into FortiWeb's site-packages Python directory. This allows the malicious code to execute using the privileges granted to Python scripts in that high-level directory. Given the use of SQL, this can lead to potential loss of data within the database.","confidence":"high"},{"id":"T1485","name":"Data Destruction","tactics":["impact"],"provenance":"source","basis":"ctid-kev","bases":["ctid-kev"],"basisDetail":"CTID Mappings Explorer KEV 07/28/2025 (ATT&CK 16.1); capability: SQL Injection","mappingType":"secondary_impact","evidence":[],"comment":"Affected versions of FortiWeb contain insufficient input sanitization, allowing for an attacker to use SQL injection to write a malicious .pth file to the into FortiWeb's site-packages Python directory. This allows the malicious code to execute using the privileges granted to Python scripts in that high-level directory. Given the use of SQL, this can lead to potential loss of data within the database.","confidence":"high"}],"reports":[],"affected":[],"advisories":[],"euvd":{"id":"EUVD-2025-21785","url":"https://euvd.enisa.europa.eu/vulnerability/EUVD-2025-21785","exploited":true,"exploitedSince":"2025-07-18","provenance":"source"},"exploits":[{"id":52473,"url":"https://www.exploit-db.com/exploits/52473","title":"FortiWeb Fabric Connector 7.6.x - SQL Injection to Remote Code Execution","type":"webapps","platform":"multiple","date":"2026-02-04","verified":false,"provenance":"source"}],"exploitSources":{"exploitdb":{"count":1,"earliest":"2026-02-04"},"pocGithub":{"count":11,"skipped":1,"earliest":"2025-07-10","earliestUrl":"https://github.com/watchtowrlabs/watchTowr-vs-FortiWeb-CVE-2025-25257","repos":[{"name":"watchtowrlabs/watchTowr-vs-FortiWeb-CVE-2025-25257","url":"https://github.com/watchtowrlabs/watchTowr-vs-FortiWeb-CVE-2025-25257","stars":100,"created":"2025-07-10"},{"name":"0xbigshaq/CVE-2025-25257","url":"https://github.com/0xbigshaq/CVE-2025-25257","stars":64,"created":"2025-07-11"},{"name":"TheStingR/CVE-2025-25257","url":"https://github.com/TheStingR/CVE-2025-25257","stars":5,"created":"2025-07-19"},{"name":"0xgh057r3c0n/CVE-2025-25257","url":"https://github.com/0xgh057r3c0n/CVE-2025-25257","stars":2,"created":"2025-07-15"},{"name":"aitorfirm/CVE-2025-25257","url":"https://github.com/aitorfirm/CVE-2025-25257","stars":1,"created":"2025-07-12"}]},"nuclei":[{"id":"CVE-2025-25257","name":"Fortinet FortiWeb - SQL Injection","severity":"critical","path":"http/cves/2025/CVE-2025-25257.yaml","url":"https://github.com/projectdiscovery/nuclei-templates/blob/main/http/cves/2025/CVE-2025-25257.yaml"}],"first":{"date":"2025-07-10","source":"PoC-in-GitHub","url":"https://github.com/watchtowrlabs/watchTowr-vs-FortiWeb-CVE-2025-25257"},"provenance":"source"},"exploitRefs":["https://packetstorm.news/files/id/210193/","https://www.exploit-db.com/exploits/52473"],"flow":[{"stage":"exploitation","techniques":["T1190","T1055","T1068"],"provenance":"source"},{"stage":"primary","techniques":["T1059.004"],"provenance":"source"},{"stage":"secondary","techniques":["T1485"],"provenance":"source"}],"timeline":[{"date":"2025-07-10","kind":"exploit-public","label":"First public exploit: PoC-in-GitHub; later: Exploit-DB 2026-02-04","url":"https://github.com/watchtowrlabs/watchTowr-vs-FortiWeb-CVE-2025-25257","provenance":"source"},{"date":"2025-07-11","kind":"exploited-reported","label":"Exploitation first reported (VulnCheck KEV evidence)","url":"https://app.crowdsec.net/cti/cve-explorer/CVE-2025-25257","provenance":"source"},{"date":"2025-07-17","kind":"published","label":"Published (NVD)","url":"https://nvd.nist.gov/vuln/detail/CVE-2025-25257","provenance":"source"},{"date":"2025-07-18","kind":"kev","label":"Added to CISA KEV","url":"https://www.cisa.gov/known-exploited-vulnerabilities-catalog","provenance":"source"},{"date":"2025-07-18","kind":"euvd-exploited","label":"ENISA EUVD: exploited","url":"https://euvd.enisa.europa.eu/vulnerability/EUVD-2025-21785","provenance":"source"}],"speed":{"daysToPublicExploit":null,"firstExploitFrom":"PoC-in-GitHub","daysToKev":1},"priority":{"score":69.9,"factors":[{"name":"In a KEV catalog","points":35.0,"detail":"listed in CISA KEV and VulnCheck KEV"},{"name":"Recent KEV listing","points":0.0,"detail":"added 477 days ago"},{"name":"Known ransomware use","points":0.0,"detail":"not known"},{"name":"EPSS percentile","points":19.99,"detail":"percentile 0.9997"},{"name":"Named in threat reports","points":0.0,"detail":"0 reports"},{"name":"Public exploit code","points":5.0,"detail":"2 NVD references tagged Exploit; 1 Exploit-DB entry; 11 PoC-in-GitHub repos; 1 nuclei template"},{"name":"Mentioned in OTX pulses","points":3.0,"detail":"50 pulses"},{"name":"CVSS severity","points":6.86,"detail":"base score 9.8"},{"name":"End-of-life product","points":0.0,"detail":"supported or unknown"}]}}