Proof-of-concept exploits have been released for a critical SQLi vulnerability in Fortinet FortiWeb that can be used to achieve pre-authenticated remote code execution on vulnerable servers. "An improper neutralization of special elements used in an SQL command ('SQL Injection') vulnerability [CWE-89] in FortiWeb may allow an unauthenticated attacker to execute unauthorized SQL code or commands via crafted HTTP or HTTPs requests," reads Fortinet's advisory. As .pth files are automatically loaded and run when Python is executed, the researchers found a legitimate FortiWeb CGI Python script (/cgi-bin/ml‑draw.py) that could be used to launch the malicious code in the .pth file and achieve remote code execution. The researchers were able to escalate the SQL injection to remote code execution by executing MySQL's SELECT … INTO OUTFILE query via the SQLi flaw to create arbitrary files on the device. This code did not properly sanitize the bearer token sent in HTTP request headers, allowing attackers to inject custom SQL into the header to achieve SQLi. Attackers can trigger the flaw through HTTP requests to the /api/fabric/device/status endpoint by injecting SQL into the Authorization header (e.g., Bearer AAAAAA'or'1'='1), allowing attackers to bypass authentication checks. The flaw is found in FortiWeb's Fabric Connector, which is software that synchronizes authentication and policy data between Fortinet products.
This Cyber News was published on www.bleepingcomputer.com. Publication date: Fri, 11 Jul 2025 19:45:20 +0000