{"id":11515,"date":"2025-07-14T12:54:06","date_gmt":"2025-07-14T05:54:06","guid":{"rendered":"https:\/\/infosec.new88088.net\/?p=11515"},"modified":"2026-06-25T10:01:40","modified_gmt":"2026-06-25T03:01:40","slug":"fortinet-patch-severe-injection-sql-infortiweb-cve-2025-25257","status":"publish","type":"post","link":"https:\/\/infosec.new88088.net\/en\/2025\/07\/14\/fortinet-patch-severe-injection-sql-infortiweb-cve-2025-25257\/","title":{"rendered":"Fortinet Patch Severe Injection SQL InfortiWeb (CVE – 2025-25257)"},"content":{"rendered":"

Fortinet recently released a patch for the CVE-2025-25257 vulnerability in its FortiWeb product. The vulnerability, scored 9.6\/10 on the CVSS scale, allows unauthenticated hackers to execute malicious SQL commands remotely and may even hijack the system if not handled in time.<\/b><\/p>\n

\n
\"1752483170886.png\"<\/div>\n<\/div>\n

The vulnerability stems from a function called get_fabric_user_by_token in the Fabric Connector component \u2013 which is responsible for connecting FortiWeb to other Fortinet products.<\/p>\n

The error belongs to the SQL Injection group (CWE – 89) \u2013 a common but extremely dangerous error that exists at the API level. When FortiWeb receives an HTTP request with a Bearer token in the header. The system will call the get construct user by token, then fabric access check.<\/p>\n

Data from this token is not properly checked and sanitized but is still fed directly into the SQL query.<\/p>\n

The result: hackers can write and execute arbitrary SQL commands on their own, even without even logging into the system.<\/p>\n

Particularly dangerous: If a SQL instruction is incorporated such as SELECT… INTO OUTFILE, hackers can write a malicious file to the system (e.g., a Python script), then execute it to gain access \u2013 from SQUL Injection to Remote Code Execution (RCE).<\/p>\n

The following FortiWeb versions are all affected:<\/p>\n