FortiWeb CVE-2025-25257 Pre-auth SQLi Exploit Attempt

Reyben Cortes@Reybendetecc

•updated Aug 25, 2025•1•82

Detects SQL injection attempts targeting FortiWeb (CVE-2025-25257) in HTTP GET requests to /api/fabric/device/status. The rule identifies known exploit payloads in the Authorization header, generic SQL injection patterns, and SQL statements like DROP, DELETE, INSERT, UPDATE, CREATE. It also detects known malicious source IPs targeting the vulnerable endpoint.