CVE-2025-25257: Unauthenticated SQL injection in GUI
An improper neutralization of special elements used in an SQL command ('SQL Injection') vulnerability [CWE-89] in FortiWeb may allow an unauthenticated attacker to execute unauthorized SQL code or commands via crafted HTTP or HTTPs requests.
Other sources
An improper neutralization of special elements used in an SQL command ('SQL Injection') vulnerability [CWE-89] vulnerability in Fortinet FortiWeb 7.6.0 through 7.6.3, FortiWeb 7.4.0 through 7.4.7, FortiWeb 7.2.0 through 7.2.10, FortiWeb 7.0.0 through 7.0.10 allows an unauthenticated attacker to execute unauthorized SQL code or commands via crafted HTTP or HTTPs requests.
— MITRE
Fortinet FortiWeb contains a SQL injection vulnerability that may allow an unauthenticated attacker to execute unauthorized SQL code or commands via crafted HTTP or HTTPs requests.
— CISA
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
Fortinet FortiWebto a version that resolves this vulnerability.Fixed in 7.6.4 - Upgrade
Upgrade
Fortinet FortiWebto a version that resolves this vulnerability.Fixed in 7.4.8 - Upgrade
Upgrade
Fortinet FortiWebto a version that resolves this vulnerability.Fixed in 7.2.11 - Upgrade
Upgrade
Fortinet FortiWebto a version that resolves this vulnerability.Fixed in 7.0.11 - Remove
Remove
Fortinet FortiWebfrom your environment.Discontinue use of the product if mitigations are unavailable.
- Compensating control
Apply mitigations per vendor instructions and follow applicable BOD 22-01 guidance for cloud services.
Event History
Frequently Asked Questions
What is the severity of CVE-2025-25257?
CVE-2025-25257 is classified as a critical vulnerability due to its potential for SQL injection and unauthorized execution of commands.
How do I fix CVE-2025-25257?
To remediate CVE-2025-25257, update FortiWeb to version 7.6.4 or later, 7.4.8 or later, 7.2.11 or later, or 7.0.11 or later.
Who is affected by CVE-2025-25257?
CVE-2025-25257 affects FortiWeb versions between 7.0.0 and 7.6.3, 7.4.0 and 7.4.7, 7.2.0 and 7.2.10.
What type of vulnerability is CVE-2025-25257?
CVE-2025-25257 is an SQL Injection vulnerability which allows attackers to inject and execute unauthorized SQL commands.
Can CVE-2025-25257 be exploited remotely?
Yes, CVE-2025-25257 can be exploited remotely by unauthenticated attackers via crafted HTTP or HTTPS requests.