Detections
Analytics

Fortinet FortiWeb Fabric Connector SQL Injection

critical Web App Scanning Plugin ID 114922

Language:

Synopsis

Fortinet FortiWeb Fabric Connector SQL Injection

Description

Fortinet FortiWeb 7.0.x < 7.0.11, 7.2.x < 7.2.11, 7.4.x < 7.4.8, 7.6.x < 7.6.4 is vulnerable to a pre-authentication SQL injection that can lead to remote code execution. By leveraging this vulnerability, a remote and unauthenticated attacker can inject malicious SQL queries into the FortiWeb Fabric Connector and fully compromise the affected system.

Solution

Upgrade to FortiWeb 7.0.11, 7.2.11, 7.4.8, or 7.6.4 or later versions to mitigate this vulnerability.

See Also

https://fortiguard.fortinet.com/psirt/FG-IR-25-151

https://labs.watchtowr.com/pre-auth-sql-injection-to-rce-fortinet-fortiweb-fabric-connector-cve-2025-25257/

Plugin Details

Severity: Critical

ID: 114922

Type: remote

Published: 7/24/2025

Updated: 7/24/2025

Scan Template: basic, full, pci, scan

Risk Information

VPR

Risk Factor: Critical

Score: 9.4

CVSS v2

Risk Factor: Critical

Base Score: 10

Vector: CVSS2#AV:N/AC:L/Au:N/C:C/I:C/A:C

CVSS Score Source: CVE-2025-25257

CVSS v3

Risk Factor: Critical

Base Score: 9.8

Vector: CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

CVSS Score Source: CVE-2025-25257

Vulnerability Information

CPE: cpe:2.3:a:fortinet:fortiweb:*:*:*:*:*:*:*:*

Exploit Available: true

Exploit Ease: Exploits are available

Vulnerability Publication Date: 7/7/2025

CISA Known Exploited Vulnerability Due Dates: 8/8/2025

Reference Information

CVE: CVE-2025-25257