FortiWeb CVE-2025-25257 SQLi RCE Attempt

Aaron Mog@AaronMogS2S

•updated Aug 18, 2025•0•22

Detects potential exploitation of FortiWeb CVE-2025-25257, a pre-authentication SQL injection vulnerability. This rule identifies an SQL injection attempt against the '/api/fabric/device/status' endpoint, followed by either a suspicious Python file drop in a library directory or a request to a specific CGI script used to trigger the payload.