imbas007/POC-CVE-2025-52970

GitHubRepository PoCExploit

PoC files

2 files

File viewing is interactive and short-lived. Downloads are password-protected ZIP archives using password eip.

GitHub
Analysisdeepseek-v4-pro:cloud ·

Technical assessment

Python script that exploits CVE-2025-52970 in FortiWeb via SQL injection in the Authorization header to write a webshell and a chmod gadget, then executes arbitrary commands.

Backdoor review

No backdoor observed in reviewed code

The PoC implements a SQL injection to RCE chain against FortiWeb CVE-2025-52970. It uploads a CGI webshell and a Python chmod gadget, then executes commands via the User-Agent header. No concealed backdoor, unrelated payload, credential theft, or persistence mechanism was observed. The code performs only the advertised exploit behavior.

ClassificationExploit
Model confidence100%
AuthenticationNot required
Languagespython
Target softwareFortinet FortiWeb
Attack typessql injectionremote code execution
Evidence & reasoningClassification basis · observed behavior · safety review
Technical evidence

Classification basis and observed behavior

Classification basis

The script actively exploits the vulnerability by sending SQL injection payloads to write a webshell and a chmod gadget, then executes arbitrary commands on the target. It does not merely detect or scan for the vulnerability.

POC-CVE-2025-52970.py:23-28POC-CVE-2025-52970.py:50-68POC-CVE-2025-52970.py:70-77

Requirements

  • Target running vulnerable FortiWeb version (7.0.0-7.0.10, 7.2.0-7.2.10, 7.4.0-7.4.7, 7.6.0-7.6.3)POC-CVE-2025-52970.py:1
  • Network access to target's /api/fabric/device/status endpointPOC-CVE-2025-52970.py:21

Observed behavior

  • Sends SQL injection payloads in the Authorization header to /api/fabric/device/statusPOC-CVE-2025-52970.py:23-28
  • Uses SQL injection to write a webshell to /migadmin/cgi-bin/x.cgi via INTO OUTFILEPOC-CVE-2025-52970.py:50-57
  • Writes a Python chmod gadget to /var/log/lib/python3.10/pylab.py and triggers it via /cgi-bin/ml-draw.pyPOC-CVE-2025-52970.py:59-68
  • Executes arbitrary OS commands by sending them in the User-Agent header to the uploaded webshellPOC-CVE-2025-52970.py:70-77
  • Provides an interactive shell that sends commands via User-Agent header and prints responsePOC-CVE-2025-52970.py:97-112
  • Saves vulnerable target URLs to vul.txt filePOC-CVE-2025-52970.py:134-137
Safety-review evidence

Behaviors behind the backdoor verdict

Observables

Webshell Upload
Writes a CGI webshell to /migadmin/cgi-bin/x.cgi that executes the User-Agent header via evalThis is the intended RCE payload for the exploit, not a hidden backdoor.POC-CVE-2025-52970.py:45-48POC-CVE-2025-52970.py:70-74
Chmod Gadget
Writes a Python script to /var/log/lib/python3.10/pylab.py that runs chmod +x on the webshellThis is part of the exploit chain to make the webshell executable.POC-CVE-2025-52970.py:41-44POC-CVE-2025-52970.py:64-65
Vulnerable Target Logging
Writes successful target URL to vul.txtThis is a common PoC logging practice and does not exfiltrate data or establish persistence.POC-CVE-2025-52970.py:135-137
Review boundaries

What the analysis did not establish

  • Evidence is limited to the supplied source code; no runtime output or network captures are provided to confirm successful exploitation.
  • The README.md references a screenshot (image) that is not included in the text evidence, so its content cannot be verified.
  • Only the two text files (Python script and README) were reviewed; no binary files were present.
  • The review does not assess whether the exploit works as claimed or is safe to execute.
Model interpretation

This review is limited to the supplied PoC code and context. It does not assert that the code works or is safe to execute.

Linked vulnerabilities

1