CVE-2025-25257

What it actually does

CVE-2025-25257 is a pre-authentication SQL injection vulnerability in Fortinet FortiWeb. A remote attacker can send crafted HTTP or HTTPS requests that are incorporated into backend SQL statements without proper neutralization, allowing unauthorized SQL execution. Because the CVSS vector is network-accessible, low-complexity, requires no credentials, and has high confidentiality, integrity, and availability impact, successful exploitation can enable database disclosure, modification of FortiWeb configuration or security policy data, administrative takeover, and potentially command execution depending on database privileges and appliance implementation details.

Why it matters to the business

Exploitation can compromise a web application firewall that is often placed in front of business-critical applications, reducing or eliminating a key protective control. Attackers may be able to steal sensitive configuration data, tamper with security policies, create or modify administrative access, disrupt traffic inspection, or use the appliance as a foothold for further intrusion. This vulnerability is listed in CISA KEV with a remediation due date of 2025-08-08, has very high EPSS likelihood, and is reported as actively exploited in the wild, making remediation urgent even where no compromise is currently suspected.

How an attack unfolds

An attacker identifies an internet-exposed or otherwise reachable FortiWeb management/API interface running an affected 7.6.x, 7.4.x, 7.2.x, or 7.0.x version. The attacker sends specially crafted HTTP or HTTPS requests containing SQL metacharacters or payloads that are not properly neutralized before being used in a database query. The injected SQL can be used to test exploitability, enumerate database structure, extract sensitive records, alter configuration or account data, and potentially write or execute commands if the database context permits it. In a full intrusion, the attacker may establish persistence by creating or modifying administrative access, disabling or weakening WAF protections, exporting configuration and secrets, and using the compromised FortiWeb appliance to support lateral movement or attacks against protected applications.

How to fix it

Upgrade Fortinet FortiWeb to a vendor-fixed release immediately. The affected ranges are FortiWeb 7.6.0 through 7.6.3, 7.4.0 through 7.4.7, 7.2.0 through 7.2.10, and 7.0.0 through 7.0.10; upgrade to the corresponding fixed branch release or later, commonly the next maintenance release after each affected range, or preferably the latest supported FortiWeb version recommended by Fortinet. If immediate upgrade is not possible, restrict FortiWeb administrative and API access to trusted management networks only, block unnecessary internet exposure, enforce VPN or jump-host access for administration, review WAF/API access controls, and monitor for SQL injection attempts. Because this is KEV-listed and actively exploited, mitigation should be treated as temporary and not a substitute for patching.

How to confirm the fix worked

Confirm the installed FortiWeb firmware version is outside the affected ranges: not 7.6.0-7.6.3, not 7.4.0-7.4.7, not 7.2.0-7.2.10, and not 7.0.0-7.0.10. Validate through the FortiWeb administrative interface, CLI, or centralized asset inventory, then compare against Fortinet’s advisory and release notes. Confirm that management/API interfaces are not exposed to untrusted networks. Where authorized, perform a safe authenticated or unauthenticated vulnerability scan using an up-to-date scanner plugin for this CVE; avoid destructive SQL injection testing on production appliances. After upgrade, verify normal WAF policy operation, administrator accounts, system configuration integrity, and absence of unexpected policy or routing changes.

Typical attack path

1. Scan for Fortinet FortiWeb appliances exposed to the internet or reachable from a compromised network segment.
2. Fingerprint the FortiWeb version or infer vulnerability from exposed behavior and response patterns.
3. Send crafted HTTP or HTTPS requests containing SQL injection payloads to a vulnerable FortiWeb endpoint.
4. Confirm successful injection using response differences, time delays, error messages, or data returned from the backend database.
5. Enumerate database tables and extract configuration, account, session, policy, or certificate-related data where accessible.
6. Modify database records to create access, alter security policy behavior, or degrade inspection capabilities.
7. Attempt to gain durable control of the appliance or use the compromised WAF position to attack downstream applications.
8. Remove or minimize obvious traces in application, access, database, or system logs where possible.

How to detect it

Review FortiWeb HTTP/HTTPS access logs, administrative logs, system event logs, configuration-change logs, and any local or remote syslog exports for unauthenticated requests containing SQL syntax, encoded SQL metacharacters, time-based injection functions, database enumeration terms, or abnormal request patterns shortly before configuration or account changes. Look for HTTP 500 errors, unusual redirects, long response times associated with requests containing SLEEP or BENCHMARK-like payloads, repeated probing from the same source IPs, and requests to administrative or API paths from untrusted networks. Inspect FortiWeb for newly created or modified administrator accounts, unexpected API users, altered WAF policies, disabled protections, modified routing or server pool settings, unexpected configuration exports, and unexplained reboots or service restarts. Where database or appliance shell telemetry is available, look for anomalous database queries, attempts to read system tables, file-write attempts, suspicious child processes, or command execution activity initiated by FortiWeb services. If the appliance forwarded traffic to downstream applications after suspected compromise, correlate application logs for requests from the FortiWeb source address that bypass expected WAF behavior or contain injection, web shell, credential theft, or reconnaissance patterns.

• UNION SELECT
• UNION/**/SELECT
• information_schema
• INFORMATION_SCHEMA
• SLEEP(
• BENCHMARK(
• WAITFOR DELAY
• LOAD_FILE(
• INTO OUTFILE
• INTO DUMPFILE
• @@version
• version()
• database()
• ' OR '1'='1
• " OR "1"="1
• OR 1=1
• --
• #
• /*
• */
• %27%20OR%20%271%27%3D%271
• %22%20OR%20%221%22%3D%221
• %55%4e%49%4f%4e%20%53%45%4c%45%43%54
• HTTP 500
• sql syntax
• SQL syntax
• mysql_fetch
• MariaDB
• MySQL

What your security team should do

• Patch or upgrade all affected FortiWeb appliances immediately; this is CISA KEV-listed, actively exploited, remotely exploitable, and unauthenticated.
• If patching cannot be completed immediately, restrict administrative/API access to trusted management sources and remove direct internet exposure.
• Perform threat hunting on FortiWeb access, admin, system, and database-related logs for SQL injection payloads and suspicious unauthenticated requests.
• Review FortiWeb administrator accounts, API users, configuration backups, WAF policies, certificates, and recent changes for unauthorized modification.
• Rotate credentials, API tokens, and secrets stored on or managed by FortiWeb if exploitation is suspected.
• Check protected applications for follow-on activity originating from or routed through the FortiWeb appliance.
• Preserve logs and forensic images before rebuilding or factory-resetting any appliance suspected of compromise.
• Track Fortinet advisories for branch-specific fixed versions, hotfixes, and any updated indicators of compromise.