关联漏洞
标题:Fortinet FortiWeb 安全漏洞 (CVE-2025-64446)Description:Fortinet FortiWeb是美国飞塔（Fortinet）公司的一款Web应用层防火墙，它能够阻断如跨站点脚本、SQL注入、Cookie中毒、schema中毒等攻击的威胁，保证Web应用程序的安全性并保护敏感的数据库内容。 Fortinet FortiWeb 8.0.0版本至8.0.1版本、7.6.0版本至7.6.4版本、7.4.0版本至7.4.9版本、7.2.0版本至7.2.11版本和7.0.0版本至7.0.11版本存在安全漏洞，该漏洞源于相对路径遍历，可能导致执行管理命令。
Description
CVE-2025-64446 - A relative path traversal vulnerability in Fortinet FortiWeb 8.0.0 through 8.0.1, FortiWeb 7.6.0 through 7.6.4, FortiWeb 7.4.0 through 7.4.9, FortiWeb 7.2.0 through 7.2.11, FortiWeb 7.0.0 through 7.0.11 may allow an attacker to execute administrative commands on the system via crafted HTTP or HTTPS requests.
介绍
# POC - CVE-2025-64446 - FortiWeb RCE via Path Traversal + Auth Bypass
[](https://whop.com/verylazytech/)
[](https://medium.com/@verylazytech)
[](https://github.com/verylazytech)
## Overview
Fortinet products are some of the most battle-tested appliances protecting enterprise networks today — and ironically, the moment a Forti appliance becomes vulnerable, the blast radius is catastrophic. In late 2025, one of the most dangerous vulnerabilities ever discovered in FortiWeb surfaced: CVE-2025-64446, a chaining vulnerability that combines:
- Path Traversal
- Internal CGI handler exposure
- Authentication Bypass via header forging
- Privilege escalation to full administrative control
All without authentication.
All via a single HTTP request.
All remotely exploitable.
**Read about it** — [CVE-2025-64446](https://nvd.nist.gov/vuln/detail/CVE-2025-64446)
> **Disclaimer**: This Proof of Concept (POC) is made for educational and ethical testing purposes only. Usage of this tool for attacking targets without prior mutual consent is illegal. It is the end user’s responsibility to obey all applicable local, state, and federal laws. Developers assume no liability and are not responsible for any misuse or damage caused by this program.
## Getting Started
### Finding Targets
To find potential targets, use Fofa (similar to Shodan.io):
- **Fofa Dork**: "body="FortiWeb" && body="app.min.js""
### Cloning the Repository
First, clone the repository:
```bash
git clone https://github.com/verylazytech/CVE-2025-64446
```
Run the Exploit:
```bash
python3 CVE-2025-64446.py <Target:port>
```
文件快照
[4.0K] /data/pocs/70824557871109f8ded396e1094047574b4d37b6
├── [3.9K] cve-2025-64446.py
└── [1.9K] README.md
1 directory, 2 files
备注
1. 建议优先通过来源进行访问。
2. 本地 POC 快照面向订阅用户开放；当原始来源失效或无法访问时，本地镜像作为订阅权益的一部分提供。
3. 持续抓取、验证、维护这份 POC 档案需要不少投入，因此本地快照已纳入付费订阅。您的订阅是让这份资料能继续走下去的关键，由衷感谢。 查看订阅方案 →