Critical Vulnerability in FortiWeb: Score 9.6 and Unauthorized SQL Commands

Redazione RHC : 13 July 2025 11:54

A new vulnerability, tracked under CVE-2025-25257, was recently published affecting several versions of Fortinet FortiWeb. This vulnerability could allow unauthenticated attackers to execute unauthorized SQL commands via forged HTTP/S requests. This vulnerability significantly impacts confidentiality, integrity, and availability and has a CVSSv3 score of 9.6.

The risk is significant, as FortiWeb instances are typically public-facing systems, making these infrastructures easy targets for threat actors during intrusions. As of 07/11/2025 there is no evidence that this vulnerability has been actively exploited.

• Last update: 11-07-2025
• Type: SQL injection
• Affected software:
  → FortiWeb 7.6: versions 7.6.0 to 7.6.3
  → FortiWeb 7.4: versions 7.4.0 to 7.4.7
  → FortiWeb 7.2: versions from 7.2.0 to 7.2.10
  → FortiWeb 7.0: versions from 7.0.0 to 7.0.10
• CVE/CVSS → CVE-2025-25257: CVSS 9.8 (CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H)

Details of bug

In affected versions, the FortiWeb administration GUI has incorrect input neutralization, resulting in unauthenticated SQL injection. This critical flaw allows attackers to:

1. Execute unauthorized SQL commands without authentication
2. Bypass access controls and extract sensitive configuration or user data
3. Modify or delete backend database entries
4. Potentially lead to complete system compromise

Recommended Actions

It is strongly recommended that you install vendor-provided updates for vulnerable devices as a top priority, after thorough testing.

Enhance monitoring and detection capabilities to identify any related suspicious activity and ensure a rapid response in the event of an intrusion.

Redazione
The editorial team of Red Hot Cyber consists of a group of individuals and anonymous sources who actively collaborate to provide early information and news on cybersecurity and computing in general.

Lista degli articoli