Multiple Fortinet FortiWeb instances recently infected with web shells are believed to have been compromised using public exploits for a recently patched remote code execution (RCE) flaw tracked as CVE-2025-25257. "An improper neutralization of special elements used in an SQL command ('SQL Injection') vulnerability in FortiWeb may allow an unauthenticated attacker to execute unauthorized SQL code or commands via crafted HTTP or HTTPs requests," explained Fortinet. On July 11, exploits were made public by cybersecurity firm WatchTowr, and a co-discoverer of the flaw, "faulty *ptrrr." These exploits demonstrated methods for planting webshells or opening reverse shells on unpatched endpoints. A legitimate FortiWeb CGI script (/cgi-bin/ml-draw.py) is then accessed remotely, causing the code in the malicious .pth file to be executed and achieving remote code execution on the device. The researchers reported that these Fortinet FortiWeb instances are believed to be compromised through the CVE-2025-25257 flaw. FortiWeb is a Web Application Firewall (WAF) used by large enterprises, government agencies, and managed security service providers to block and detect unwanted HTTP traffic. Bill Toulas Bill Toulas is a tech writer and infosec news reporter with over a decade of experience working on various online publications, covering open-source, Linux, malware, data breach incidents, and hacks.
This Cyber News was published on www.bleepingcomputer.com. Publication date: Wed, 16 Jul 2025 15:00:15 +0000