ExploitPublished
FortiWeb Fabric Connector 7.6.x · SQL Injection to Remote Code Execution
Source Exploit-DB RSS Feed
0
Severity
CriticalRated by Threat Radar
Data as of 10 Apr 2026, 00:24 UTC
What to do
AI-suggested
Until an official fix is available, restrict access to the FortiWeb Fabric Connector interface and monitor for suspicious activity related to SQL injection attempts.
Description
FortiWeb Fabric Connector 7.6.x - SQL Injection to Remote Code Execution
Indicators of compromise
Exploit source code
# Exploit Title: FortiWeb Fabric Connector 7.6.x - Pre-authentication SQL
Injection to Remote Code Execution
# Date: 2025-10-05
# Exploit Author: Milad Karimi (Ex3ptionaL)
# Contact: miladgrayhat@gmail.com
# Zone-H: www.zone-h.org/archive/notifier=Ex3ptionaL
# Tested on: Win, Ubuntu
# CVE : CVE-2025-25257
Overview
CVE-2025-25257 is a pre-authentication SQL Injection vulnerability in
Fortinet FortiWeb Fabric Connector versions 7.0 through 7.6.x.
This flaw allows attackers to inject malicious SQ…References
Community reviews
Loading reviews…