FortiWeb Pre-Auth SQL Injection to RCE CVE-2025-25257

Aaron Mog@AaronMogS2S

•updated Aug 18, 2025•1•0•60

Detects attempts to exploit FortiWeb Pre-Auth SQL Injection leading to Remote Code Execution (CVE-2025-25257) via the /api/fabric/device/status endpoint. The rule specifically looks for SQL injection payloads, including boolean-based and INTO OUTFILE techniques, within the Authorization header of HTTP requests.