关联漏洞
标题：
Fortinet FortiWeb SQL注入漏洞
(CVE-2025-25257)
描述：Fortinet FortiWeb是美国飞塔（Fortinet）公司的一款Web应用层防火墙，它能够阻断如跨站点脚本、SQL注入、Cookie中毒、schema中毒等攻击的威胁，保证Web应用程序的安全性并保护敏感的数据库内容。 Fortinet FortiWeb 7.6.3及之前版本、7.4.7及之前版本、7.2.10及之前版本和7.0.10之前版本存在SQL注入漏洞，该漏洞源于对SQL命令中特殊元素中和不当，可能导致SQL注入攻击。
描述
Exploiting the CVE-2025-25257 vulnerability in FortiWeb. This repository demonstrates secure pre-authenticated SQL injection.
介绍
## Table of Contents
- [Overview](#overview)
- [Vulnerability Details](#vulnerability-details)
- [Proof of Concept (PoC)](#proof-of-concept-poc)
- [Trolled2](#environment-setup)
- [Trolled3](#mitigation-and-patching)
---
## Overview
CVE-2025-25257 is a **pre-authentication SQL Injection vulnerability** in Fortinet FortiWeb Fabric Connector versions 7.0 through 7.6.x.
This flaw allows attackers to inject malicious SQL commands into the vulnerable API endpoint, potentially leading to **Remote Code Execution (RCE)**.
This repository contains an **PoC** demonstrating the SQL injection vector in a safe and controlled manner.
Its open source for you to exploit.-
---
## Vulnerability Details
- **Name:** FortiWeb Fabric Connector SQL Injection
- **CVE:** [CVE-2025-25257](https://nvd.nist.gov/vuln/detail/CVE-2025-25257)
- **Affected Versions:** FortiWeb Fabric Connector 7.0 through 7.6.x
- **Severity:** Critical (CVSS Score 9.8)
- **Impact:** Pre-authentication SQL Injection, leading to Remote Code Execution
- **Attack Vector:** HTTP API `/api/fabric/device/status`
- **Exploitation:** Requires malicious `Authorization: Bearer` header with crafted payload
---
## Proof of Concept (PoC)
The following `curl` command demonstrates the **SQL Injection detection** *you can* executing harmful payloads:
```bash
curl -k -H "Authorization: Bearer aaa' OR '1'='1" \
https://<fortiweb-ip>/api/fabric/device/status
文件快照
[4.0K] /data/pocs/abe3de350380c2fe95b502bdbded82165d616377
├── [4.0K] java
│ └── [ 808] poc.js
├── [1.4K] README.md
└── [4.0K] src
├── [ 613] detect.py
└── [ 741] poc.py
2 directories, 4 files
备注
1. 建议优先通过来源进行访问。
2. 如果因为来源失效或无法访问，请发送邮箱到 f.jinxu#gmail.com 索取本地快照（把 # 换成 @）。
3. 神龙已为您对POC代码进行快照，为了长期维护，请考虑为本地POC付费，感谢您的支持。