CVE-2025-25257

Fortinet FortiWeb SQL Injection Vulnerability

Fortiweb

An improper neutralization of special elements used in an SQL command ('SQL Injection') vulnerability [CWE-89] vulnerability in Fortinet FortiWeb 7.6.0 through 7.6.3, FortiWeb 7.4.0 through 7.4.7, FortiWeb 7.2.0 through 7.2.10, FortiWeb 7.0.0 through 7.0.10 allows an unauthenticated attacker to execute unauthorized SQL code or commands via crafted HTTP or HTTPs requests.

17. Jul 2025

Ausgewertete Quellen

• Hersteller
  https://fortiguard.fortinet.com/psirt/FG-IR-25-151
• Hinweis
  https://packetstorm.news/files/id/210193/
• Hinweis
  https://www.exploit-db.com/exploits/52473
• CISA
  https://www.cisa.gov/known-exploited-vulnerabilities-catalog?field_cve=CVE-2025-25257
• CISA
  Fortinet FortiWeb SQL Injection Vulnerability
• NVD
  CVE-2025-25257
• GitHub
  https://github.com/0xbigshaq/CVE-2025-25257