CVE-2025-52970
HIGH EXPLOITED NUCLEIFortinet FortiWeb <7.6.3 - Privilege Escalation
Title source: llmExploitation Summary
CVE-2025-52970 has been observed exploited in the wild (reported by VulnCheck KEV). EIP tracks 3 public exploits from researchers including Hex00-0x4, 34zY, imbas007. A Nuclei detection template is also available.
AI-analyzed exploit summary This repository contains a functional exploit for CVE-2025-52970, demonstrating an authentication bypass in FortiWeb via SQL injection, leading to remote code execution (RCE) through webshell upload and command execution via HTTP headers.
Description
A improper handling of parameters in Fortinet FortiWeb versions 7.6.3 and below, versions 7.4.7 and below, versions 7.2.10 and below, and 7.0.10 and below may allow an unauthenticated remote attacker with non-public information pertaining to the device and targeted user to gain admin privileges on the device via a specially crafted request.
Exploits (3)
This repository contains a functional exploit for CVE-2025-52970, demonstrating an authentication bypass in FortiWeb via SQL injection, leading to remote code execution (RCE) through webshell upload and command execution via HTTP headers.
This repository contains a functional exploit for CVE-2025-52970, demonstrating an authentication bypass leading to remote code execution (RCE) on Fortinet FortiWeb. The exploit leverages SQL injection via a vulnerable API endpoint to upload a webshell and achieve command execution.
This repository contains a functional exploit for CVE-2025-52970, demonstrating an SQL injection vulnerability in FortiWeb that leads to remote code execution (RCE). The exploit chains SQL injection to upload a webshell and execute arbitrary commands.
Nuclei Templates (1)
http.title:"FortiWeb" || http.title:"Fortinet"
app="Fortinet-FortiWeb"
References (2)
Scores
CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H