FortiWeb SQL injection vulnerability exploited in wild
Free public brief. The indicators, the detections with Splunk SPL already written (plus Elastic and KQL where they apply), and a Slack alert the next time this touches a vendor you run are in the app — free account, no card.
Unauthenticated SQL injection in FortiWeb WAF allows arbitrary code execution; actively exploited with public PoC available.
A SQL injection vulnerability in Fortinet FortiWeb (CVE-2025-25257) allows unauthenticated attackers to execute arbitrary SQL commands via crafted HTTP/HTTPS requests. The vulnerability affects FortiWeb 7.0.0–7.0.10, 7.2.0–7.2.10, 7.4.0–7.4.7, and 7.6.0–7.6.3. According to Fortinet PSIRT, proof-of-concept code is publicly available and the vulnerability is being actively exploited in the wild. Successful exploitation could lead to arbitrary code execution in the system context, representing a critical risk to organizations running affected WAF versions.
Defenders should prioritize immediate patching of vulnerable FortiWeb instances. Organizations must apply updates from Fortinet to all affected versions after appropriate testing. In addition to patching, defenders should implement network segmentation to isolate critical systems, enable vulnerability scanning to identify affected deployments, establish and maintain a robust vulnerability management process, and consider deploying exploit protection mechanisms where available. The advisory recommends conducting both authenticated and unauthenticated vulnerability scans on a quarterly or more frequent basis.
Mentioned in this report
Detection guidance
SQL Injection Patterns in Web Request URI Query
Detects HTTP requests whose URI query contains common SQL injection constructs (UNION SELECT, boolean tautologies, time-delay functions, information_schema), as used against public-facing apps such as FortiWeb CVE-2025-25257. Auto-generated starting point — validate and tune in your environment before deploying. IOC matches can false-positive on shared infrastructure and decay as adversary infrastructure rotates.
title: SQL Injection Patterns in Web Request URI Query
id: 6da4b049-da90-5737-9de4-2d261a124d89
status: experimental
description: Detects HTTP/HTTPS requests with SQL injection constructs in the URI
query string (UNION SELECT, tautologies, time-delay functions, information_schema
access). Relevant to unauthenticated SQL injection exploitation of public-facing
appliances such as FortiWeb (CVE-2025-25257). Tune on web server or reverse proxy
logs in front of or on the exposed service.
tags:
- attack.initial-access
- attack.t1190
logsource:
category: webserver
detection:
selection:
cs-uri-query|contains:
- union select
- union%20select
- union+select
- union all select
- union%20all%20select
- ''' or ''1''=''1'
- '%27%20or%20%271%27%3d%271'
- ''' or 1=1'
- sleep(
- benchmark(
- pg_sleep(
- waitfor delay
- waitfor%20delay
- information_schema
- extractvalue(
- updatexml(
filter_scanner_internal:
c-ip|startswith:
- '127.'
- ::1
condition: selection and not filter_scanner_internal
falsepositives:
- Authorized vulnerability scanners and penetration tests against the web application
- Applications that legitimately pass SQL-like text in query parameters, such as developer
documentation or SQL tutorial sites
level: medium
author: Vorant
references:
- https://www.cisecurity.org/advisory/a-vulnerability-in-fortiweb-could-allow-for-sql-injection_2025-063
SQL Injection Attempting File Read or Write via Web Request
Detects web requests with SQL file-access primitives (LOAD_FILE, INTO OUTFILE/DUMPFILE, xp_cmdshell) in the URI query, indicating file discovery/collection or code execution via SQL injection. Auto-generated starting point — validate and tune in your environment before deploying. IOC matches can false-positive on shared infrastructure and decay as adversary infrastructure rotates.
title: SQL Injection Attempting File Read or Write via Web Request
id: 1ad84896-bf1e-57c8-ab8f-028cc19a37c3
status: experimental
description: Detects SQL injection payloads in the URI query that use database file-access
primitives (LOAD_FILE, INTO OUTFILE, INTO DUMPFILE, xp_cmdshell, COPY ... PROGRAM).
These indicate an attacker using SQL injection to read local files or write files
toward code execution, as in exploitation of unauthenticated SQL injection on public-facing
appliances like FortiWeb.
tags:
- attack.collection
- attack.t1005
- attack.discovery
- attack.t1083
- attack.initial-access
- attack.t1190
logsource:
category: webserver
detection:
selection:
cs-uri-query|contains:
- load_file(
- into outfile
- into%20outfile
- into+outfile
- into dumpfile
- into%20dumpfile
- into+dumpfile
- xp_cmdshell
- copy%20%28select
- from program
condition: selection
falsepositives:
- Authorized penetration tests or DAST scans against the web application
- Web-based database administration tools that send SQL in query parameters
level: high
author: Vorant
references:
- https://www.cisecurity.org/advisory/a-vulnerability-in-fortiweb-could-allow-for-sql-injection_2025-063
Behavioural rules are generated from public reporting — validate in your environment before deploying.
Source reporting: https://www.cisecurity.org/advisory/a-vulnerability-in-fortiweb-could-allow-for-sql-injection_2025-063
What this brief leaves out
This page is the free tier: the write-up, the severity, the names. In the app the same report carries its extracted indicators, its detections (Splunk SPL already written, plus Elastic and Microsoft KQL where they apply), the actors and CVEs it names as live profiles, and the vendor research on the same campaign — the primary source the news paraphrased, cited and read directly.
It sits in a corpus of 13,854 reports from 146 sources, 616 of them written in the last seven days, and it grows through the day.
A new account starts with three days of all of it, no card, then keeps the government and CERT reporting free. Name the vendors you run and Slack hears about the reports that touch them — about forty a week that are yours, not the four hundred that are not.
Create a free account What it costs