CVE-2025-25257

The FortiWeb application improperly neutralizes special characters in input data passed to SQL queries. An attacker can send a crafted HTTP or HTTPS request containing a malicious SQL payload without needing any credentials. The vulnerability allows injection and execution of unauthorized SQL commands directly in the device's database layer.

An unauthenticated attacker can gain full access to data stored in the database, modify or delete configuration data, and potentially take control of the device — which in the case of a WAF device means compromising the entire protected network infrastructure.

FortiWeb must be immediately updated to a version containing the patch according to the vendor's advisory (FG-IR-25-151) available at https://fortiguard.fortinet.com/psirt/FG-IR-25-151. Until the update is applied, consider restricting access to the device's management interface to trusted IP addresses only.

Fortinet FortiWeb in versions: 7.6.0–7.6.3, 7.4.0–7.4.7, 7.2.0–7.2.10, 7.0.0–7.0.10

Apply mitigations per vendor instructions, follow applicable BOD 22-01 guidance for cloud services, or discontinue use of the product if mitigations are unavailable.

Fortinet FortiWeb contains a SQL injection vulnerability that may allow an unauthenticated attacker to execute unauthorized SQL code or commands via crafted HTTP or HTTPs requests.