CVE-2025-25257

CVE-2025-25257 CVE‑2025‑25257 est une vulnérabilité critique d'injection SQL de pré-authentification affectant le composant Fabric Connector de Fortinet FortiWeb. Elle affecte les versions de FortiWeb : 7.6.0–7.6.3 7.4.0–7.4.7 7.2.0–7.2.10 ≤ 7.0.10 Détails techniques Le problème réside dans la...

Fortinet-FortiWeb-Fabric-Connector-CVE-2025-25257-Detection

Référentiel d'ingénierie de détection CVE-2025-25257 Vue d'ensemble Ce référentiel fournit du contenu d'ingénierie de détection prêt pour la production pour CVE-2025-25257 , une vulnérabilité d'injection SQL sans authentification dans Fortinet FortiWeb Fabric Connector, versions 7.0 à 7.6.x. Une...

CVE-2025-25257

목차 개요 취약점 세부 정보 개념 증명 PoC Trolled2 Trolled3 개요 CVE-2025-25257는 사전 인증 SQL 인젝션 취약점 으로, Fortinet FortiWeb Fabric Connector 버전 7.0부터 7.6.x까지 영향을 미칩니다. 이 결함을 통해 공격자는 취약한 API 엔드포인트에 악의적인 SQL 명령을 주입할 수 있으며, 잠재적으로 원격 코드 실행RCE으로 이어질 수 있습니다. 이 저장소는 SQL 인젝션 벡터를 안전하고 통제된 방식으로 설명하는 PoC 를 포함하고 있습니다. 오픈 소스로 제공되...

CVE-2025-25257

CVE-2025-25257 - ثغرة SQL Injection إلى تنفيذ أوامر عن بُعد RCE في FortiWeb بدون مصادقة 07/09/2025 بواسطة TheStingR إخلاء مسؤولية: هذا الدليل البرهاني على المفهوم PoC مقدم لأغراض الاختبارات الأمنية المصرح بها والبحث فقط. الاستخدام غير المصرح به ضد أنظمة لا تمتلكها أو ليس لديك إذن صريح لاختبارها غ...

Exploit for SQL Injection in Fortinet Fortiweb

CVE-2025-25257 Detection Engineering Repository !CVEhttps:...

FortiWeb Fabric Connector 7.6.x - SQL Injection to Remote Code Execution

Exploit Title: FortiWeb Fabric Connector 7.6.x - Pre-authentication SQL Injection to Remote Code Execution Date: 2025-10-05 Exploit Author: Milad Karimi Ex3ptionaL Contact: [email protected] Zone-H: www.zone-h.org/archive/notifier=Ex3ptionaL Tested on: Win, Ubuntu CVE : CVE-2025-25257 Overvi...

📄 FortiWeb Fabric Connector 7.6.x SQL Injection / Remote Code Execution

This proof of concept exploit demonstrates a pre-authentication remote SQL injection vulnerability in Fortinet FortiWeb Fabric Connector versions 7.0 through 7.6.x. The flaw allows unauthenticated attackers to achieve remote code execution through malicious SQL queries in the Authorization header...

📄 FortiWeb Fabric Connector 7.6.x SQL Injection

FortiWeb Fabric Connector versions 7.6.x suffer from a pre-authentication remote SQL injection vulnerability. Exploit Title: FortiWeb Fabric Connector 7.6.x - Pre-authentication SQL Injection to Remote Code Execution Date: 2025-10-05 Exploit Author: Milad Karimi Ex3ptionaL Contact:...

The vulnerability of the get_fabric_user_by_token() function in the Fabric Connector network interface component of the FortiWeb web application allows a attacker to execute arbitrary code or commands.

The vulnerability of the getfabricuserbytoken function in the Fabric Connector network interface component of the FortiWeb web application is related to the improper handling of HTTP requests with the Authorization header. Exploiting this vulnerability allows a malicious actor to execute arbitrar...