The vulnerability allows for SQL injection attacks where malicious SQL code is injected into database queries, potentially enabling attackers to read, modify, or delete sensitive data stored in the backend database. The fact that unauthenticated attackers can exploit this vulnerability significantly amplifies its risk profile, as no prior system access or credentials are required to launch attacks. The vulnerability affects multiple FortiWeb versions across different release branches. The FortiWeb SQL injection vulnerability originates from the product’s GUI component’s improper input validation mechanisms. Critical FortiWeb flaw, CVE-2025-25257, lets attackers run malicious SQL via crafted requests. The vulnerability has been assigned CVE-2025-25257 and carries a CVSS v3 score of 9.6, indicating its critical severity level. This could lead to complete system compromise, data exfiltration, service disruption, or lateral movement within the network infrastructure. FortiWeb 7.2 versions 7.2.0 through 7.2.10 require upgrading to 7.2.11 or above, while FortiWeb 7.0 versions 7.0.0 through 7.0.10 need upgrading to 7.0.11 or above. Exploitation can compromise data and system security. FortiWeb 7.4 versions 7.4.0 through 7.4.7 need upgrading to 7.4.8 or above.
This Cyber News was published on cybersecuritynews.com. Publication date: Wed, 09 Jul 2025 10:35:09 +0000