CVE-2025-25257
Published: 17 July 2025
Summary
CVE-2025-25257 is a critical-severity SQL Injection (CWE-89) vulnerability in Fortinet Fortiweb. Its CVSS base score is 9.8 (Critical).
Operationally, exploitation aligns with the MITRE ATT&CK technique Data from Local System (T1005); ranked in the top 4.2% of CVEs by exploit likelihood; CISA has added it to the Known Exploited Vulnerabilities catalog; a public proof-of-concept is referenced.
The strongest mitigations our analysis identified are NIST 800-53 RA-5 (Vulnerability Monitoring and Scanning) and SI-10 (Information Input Validation).
Threat & Defense at a Glance
Threat & Defense Details
Mitigating Controls (NIST 800-53 r5)AI
Directly remediates the SQL injection vulnerability by applying Fortinet patches for affected FortiWeb versions.
Requires validation of HTTP/HTTPS inputs to neutralize special elements and prevent SQL command injection.
Scans for and identifies the SQL injection vulnerability in FortiWeb instances, enabling proactive patching.
MITRE ATT&CK Enterprise TechniquesAI
Why these techniques?
SQL injection enables unauthenticated arbitrary SQL execution (T1190), allowing database data collection (T1213.006) and local file read/write operations as demonstrated in the PoC (T1005).
NVD Description
An improper neutralization of special elements used in an SQL command ('SQL Injection') vulnerability [CWE-89] vulnerability in Fortinet FortiWeb 7.6.0 through 7.6.3, FortiWeb 7.4.0 through 7.4.7, FortiWeb 7.2.0 through 7.2.10, FortiWeb 7.0.0 through 7.0.10 allows an unauthenticated attacker to execute…
more
unauthorized SQL code or commands via crafted HTTP or HTTPs requests.
Deeper analysisAI
CVE-2025-25257 is an SQL injection vulnerability (CWE-89) in Fortinet FortiWeb, affecting versions 7.6.0 through 7.6.3, 7.4.0 through 7.4.7, 7.2.0 through 7.2.10, and 7.0.0 through 7.0.10. The flaw arises from improper neutralization of special elements used in SQL commands, enabling an unauthenticated attacker to execute unauthorized SQL code or commands through crafted HTTP or HTTPS requests. Published on 2025-07-17, it carries a CVSS v3.1 base score of 9.8 (AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H).
Unauthenticated remote attackers can exploit this vulnerability over the network with low attack complexity, requiring no privileges or user interaction. Exploitation involves sending specially crafted requests to a vulnerable FortiWeb instance, allowing arbitrary SQL command execution. This can result in high impacts to confidentiality, integrity, and availability, such as data exfiltration, modification, or denial of service.
Fortinet's PSIRT advisory (FG-IR-25-151) details mitigation steps, including available patches for affected versions. Security practitioners should consult this advisory for upgrade guidance and workarounds.
Public proof-of-concept exploits are available on Exploit-DB (ID 52473), Packet Storm, and GitHub (0xbigshaq/CVE-2025-25257). The vulnerability is listed in CISA's Known Exploited Vulnerabilities catalog, indicating real-world exploitation.
Details
- CWE(s)
- KEV Date Added
- 18 July 2025