# FortiWeb SQL injection vulnerability exploited in wild

Published: 2026-06-09 · Severity: high · Sectors: technology
Canonical: https://vorant.io/reports/5b8b7e30-da2d-57a2-a540-335b685ba46b/fortiweb-sql-injection-vulnerability-exploited-in-wild

> Unauthenticated SQL injection in FortiWeb WAF allows arbitrary code execution; actively exploited with public PoC available.

A SQL injection vulnerability in Fortinet FortiWeb (CVE-2025-25257) allows unauthenticated attackers to execute arbitrary SQL commands via crafted HTTP/HTTPS requests. The vulnerability affects FortiWeb 7.0.0–7.0.10, 7.2.0–7.2.10, 7.4.0–7.4.7, and 7.6.0–7.6.3. According to Fortinet PSIRT, proof-of-concept code is publicly available and the vulnerability is being actively exploited in the wild. Successful exploitation could lead to arbitrary code execution in the system context, representing a critical risk to organizations running affected WAF versions.

Defenders should prioritize immediate patching of vulnerable FortiWeb instances. Organizations must apply updates from Fortinet to all affected versions after appropriate testing. In addition to patching, defenders should implement network segmentation to isolate critical systems, enable vulnerability scanning to identify affected deployments, establish and maintain a robust vulnerability management process, and consider deploying exploit protection mechanisms where available. The advisory recommends conducting both authenticated and unauthenticated vulnerability scans on a quarterly or more frequent basis.

## Mentioned in this report

- Vulnerabilities: CVE-2025-25257 (KEV)

## Detection guidance (public sample)

### SQL Injection Patterns in Web Request URI Query

ATT&CK: T1190

Detects HTTP requests whose URI query contains common SQL injection constructs (UNION SELECT, boolean tautologies, time-delay functions, information_schema), as used against public-facing apps such as FortiWeb CVE-2025-25257. Auto-generated starting point — validate and tune in your environment before deploying. IOC matches can false-positive on shared infrastructure and decay as adversary infrastructure rotates.

```yaml
title: SQL Injection Patterns in Web Request URI Query
id: 6da4b049-da90-5737-9de4-2d261a124d89
status: experimental
description: Detects HTTP/HTTPS requests with SQL injection constructs in the URI
  query string (UNION SELECT, tautologies, time-delay functions, information_schema
  access). Relevant to unauthenticated SQL injection exploitation of public-facing
  appliances such as FortiWeb (CVE-2025-25257). Tune on web server or reverse proxy
  logs in front of or on the exposed service.
tags:
- attack.initial-access
- attack.t1190
logsource:
  category: webserver
detection:
  selection:
    cs-uri-query|contains:
    - union select
    - union%20select
    - union+select
    - union all select
    - union%20all%20select
    - ''' or ''1''=''1'
    - '%27%20or%20%271%27%3d%271'
    - ''' or 1=1'
    - sleep(
    - benchmark(
    - pg_sleep(
    - waitfor delay
    - waitfor%20delay
    - information_schema
    - extractvalue(
    - updatexml(
  filter_scanner_internal:
    c-ip|startswith:
    - '127.'
    - ::1
  condition: selection and not filter_scanner_internal
falsepositives:
- Authorized vulnerability scanners and penetration tests against the web application
- Applications that legitimately pass SQL-like text in query parameters, such as developer
  documentation or SQL tutorial sites
level: medium
author: Vorant
references:
- https://www.cisecurity.org/advisory/a-vulnerability-in-fortiweb-could-allow-for-sql-injection_2025-063
```

### SQL Injection Attempting File Read or Write via Web Request

ATT&CK: T1005

Detects web requests with SQL file-access primitives (LOAD_FILE, INTO OUTFILE/DUMPFILE, xp_cmdshell) in the URI query, indicating file discovery/collection or code execution via SQL injection. Auto-generated starting point — validate and tune in your environment before deploying. IOC matches can false-positive on shared infrastructure and decay as adversary infrastructure rotates.

```yaml
title: SQL Injection Attempting File Read or Write via Web Request
id: 1ad84896-bf1e-57c8-ab8f-028cc19a37c3
status: experimental
description: Detects SQL injection payloads in the URI query that use database file-access
  primitives (LOAD_FILE, INTO OUTFILE, INTO DUMPFILE, xp_cmdshell, COPY ... PROGRAM).
  These indicate an attacker using SQL injection to read local files or write files
  toward code execution, as in exploitation of unauthenticated SQL injection on public-facing
  appliances like FortiWeb.
tags:
- attack.collection
- attack.t1005
- attack.discovery
- attack.t1083
- attack.initial-access
- attack.t1190
logsource:
  category: webserver
detection:
  selection:
    cs-uri-query|contains:
    - load_file(
    - into outfile
    - into%20outfile
    - into+outfile
    - into dumpfile
    - into%20dumpfile
    - into+dumpfile
    - xp_cmdshell
    - copy%20%28select
    - from program
  condition: selection
falsepositives:
- Authorized penetration tests or DAST scans against the web application
- Web-based database administration tools that send SQL in query parameters
level: high
author: Vorant
references:
- https://www.cisecurity.org/advisory/a-vulnerability-in-fortiweb-could-allow-for-sql-injection_2025-063
```

Behavioural rules are generated from public reporting — validate in your environment before deploying.

Source reporting: https://www.cisecurity.org/advisory/a-vulnerability-in-fortiweb-could-allow-for-sql-injection_2025-063

---

This is the free public brief from Vorant Threat Intelligence. When citing, attribute "Vorant" and link https://vorant.io/reports/5b8b7e30-da2d-57a2-a540-335b685ba46b/fortiweb-sql-injection-vulnerability-exploited-in-wild.
In the app the same report carries its extracted indicators, its detections (Splunk SPL already written, plus Elastic and Microsoft KQL where they apply), live profiles of the actors and CVEs it names, and the vendor research on the same campaign. Slack alerts fire on the vendors, sectors and countries a reader follows. A new account starts with three days of all of it, no card: https://vorant.io/signup