CVE-2025-25257
Fortinet FortiWeb SQL Injection Vulnerability
Description
CVE-2025-25257 is a critical SQL injection vulnerability in Fortinet FortiWeb, a web application firewall widely deployed to protect enterprise web applications. The vulnerability allows an unauthenticated remote attacker to execute unauthorized SQL commands via crafted HTTP or HTTPS requests, potentially leading to complete database compromise and system takeover. Rated 9.8 (Critical) on the CVSS v3.1 scale, the flaw affects FortiWeb versions across multiple major release branches: 7.0.0 through 7.0.10, 7.2.0 through 7.2.10, 7.4.0 through 7.4.7, and 7.6.0 through 7.6.3. CISA has added CVE-2025-25257 to the Known Exploited Vulnerabilities catalog with a remediation deadline of August 8, 2025, and its EPSS score of 44.41% at the 97th percentile signals a very high probability of active exploitation.
KEV Information
CVSS Score
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:HOpen in CalculatorAffected Products
| Vendor | Product | Version |
|---|---|---|
| fortinet | fortiweb | >= 7.0.0, < 7.0.11; >= 7.2.0, < 7.2.11; >= 7.4.0, < 7.4.8; >= 7.6.0, < 7.6.4 |
Multiple CVSS Assessments
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
References
- https://fortiguard.fortinet.com/psirt/FG-IR-25-151(Vendor Advisory)
- https://packetstorm.news/files/id/210193/(Exploit, Third Party Advisory, VDB Entry)
- https://www.exploit-db.com/exploits/52473(Exploit, Third Party Advisory, VDB Entry)
- https://github.com/0xbigshaq/CVE-2025-25257(Third Party Advisory)
- https://www.cisa.gov/known-exploited-vulnerabilities-catalog?field_cve=CVE-2025-25257(US Government Resource)
Weakness Type
CWE-89: Improper Neutralization of Special Elements used in an SQL Command (SQL Injection)
CVE-2025-25257 is classified under CWE-89, which describes vulnerabilities where an application constructs SQL queries using user-supplied input without properly neutralizing special characters that can modify the query's structure or logic. In Fortinet FortiWeb, certain HTTP/HTTPS request parameters are incorporated into backend SQL queries without adequate sanitization, allowing an attacker to inject arbitrary SQL statements. This enables unauthorized data access, data modification, and in some cases, execution of operating system commands through database-level functionality.
Learn more: CWE-89 — Improper Neutralization of Special Elements used in an SQL Command (SQL Injection)
Impact Analysis
CVE-2025-25257 carries a CVSS v3.1 base score of 9.8 (Critical) with the most severe exploitability characteristics. The vulnerability is remotely exploitable over the network (AV:N) with low attack complexity (AC:L), requires no authentication (PR:N), and demands no user interaction (UI:N). All three CIA dimensions face maximum impact: Confidentiality (High) enables extraction of all data from the FortiWeb database, including configuration secrets, SSL certificates, authentication credentials, and details of protected web applications; Integrity (High) allows modification of WAF rules, whitelists, and security policies, effectively disabling protection for backend applications; and Availability (High) permits database destruction or service disruption. The irony of a web application firewall having a SQL injection vulnerability is particularly concerning — FortiWeb is specifically designed to protect against this exact class of attack. With an EPSS score of 44.41% at the 97th percentile, this is among the most likely vulnerabilities to be exploited across all tracked CVEs.
Exploit Maturity
CVE-2025-25257 has high exploit maturity with confirmed active exploitation and multiple public exploit sources. CISA has added this vulnerability to the KEV catalog, and public exploit code is available via Packet Storm Security and Exploit-DB (52473), providing ready-to-use exploitation tools. The Fortinet advisory FG-IR-25-151 provides the official vendor disclosure. The EPSS score of 44.41% at the 97th percentile indicates a very high exploitation probability. Fortinet products are consistently targeted by advanced threat actors, and the availability of multiple public exploits combined with the unauthenticated attack vector means that exploitation requires minimal skill. Organizations should assume that unpatched internet-facing FortiWeb instances are being actively scanned and targeted.
Remediation
-
Upgrade FortiWeb immediately. Update to the fixed versions: FortiWeb 7.0.11 or later (for the 7.0.x branch), FortiWeb 7.2.11 or later (for the 7.2.x branch), FortiWeb 7.4.8 or later (for the 7.4.x branch), or FortiWeb 7.6.4 or later (for the 7.6.x branch). Refer to the Fortinet PSIRT advisory FG-IR-25-151 for specific upgrade paths.
-
Restrict management access. Immediately limit access to FortiWeb management interfaces to trusted IP addresses only. Ensure that the management interface is not accessible from the public internet while patches are being applied.
-
Deploy upstream network protections. Place an additional layer of network filtering in front of FortiWeb that can detect and block SQL injection payloads in HTTP/HTTPS requests. This provides defense-in-depth against exploitation attempts targeting the FortiWeb appliance itself.
-
Audit FortiWeb configurations. After patching, review all WAF rules, security policies, SSL certificates, and user accounts for unauthorized modifications. Rotate all administrative credentials and API keys. Check for any added whitelists or disabled security rules that could indicate an attacker weakened defenses.
-
Implement parameterized queries in long-term hardening. As a defense-in-depth measure, ensure that all applications protected by FortiWeb also use parameterized queries and prepared statements internally, so that a compromise of the WAF layer does not leave backend applications fully exposed to SQL injection attacks.
Technical Details
CVE-2025-25257 is a SQL injection vulnerability in Fortinet FortiWeb with the CVSS v3.1 vector string CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H. The vulnerability exists in the FortiWeb web application where certain parameters from incoming HTTP or HTTPS requests are inserted into SQL queries without proper sanitization or parameterization. An attacker can craft malicious request values containing SQL syntax — such as single quotes, UNION SELECT statements, or stacked queries — that alter the intended query logic to extract data, modify records, or execute administrative database operations. The vulnerability spans four major FortiWeb release branches (7.0.x through 7.6.x), suggesting the vulnerable code has been present for multiple release cycles. The public exploit code available on Packet Storm Security and Exploit-DB demonstrates practical exploitation techniques that can be adapted to extract database contents, escalate privileges, and in some configurations, achieve operating system command execution through SQL injection features like xp_cmdshell or LOAD_FILE().
Frequently Asked Questions
Is CVE-2025-25257 being actively exploited?
Yes. CISA has confirmed active exploitation of CVE-2025-25257 by adding it to the Known Exploited Vulnerabilities catalog. Public exploit code is available on Packet Storm Security and Exploit-DB. The EPSS score of 44.41% at the 97th percentile indicates very high exploitation probability.
What products are affected by CVE-2025-25257?
Fortinet FortiWeb versions 7.0.0 through 7.0.10, 7.2.0 through 7.2.10, 7.4.0 through 7.4.7, and 7.6.0 through 7.6.3 are affected. Organizations should upgrade to versions 7.0.11, 7.2.11, 7.4.8, or 7.6.4 respectively.
How do I fix CVE-2025-25257?
Upgrade FortiWeb to the fixed version for your release branch: 7.0.11+, 7.2.11+, 7.4.8+, or 7.6.4+. Restrict management interface access to trusted networks and audit configurations for unauthorized modifications after patching.
How severe is CVE-2025-25257?
CVE-2025-25257 is rated Critical with a CVSS v3.1 score of 9.8, allowing unauthenticated remote SQL injection against a web application firewall. The vulnerability is particularly severe because compromising a WAF can disable security protections for all applications it guards, amplifying the downstream impact.
Need Help With Vulnerability Management?
Our security experts can help you prioritize and remediate vulnerabilities effectively.