Unauthenticated OS Command Injection in Fortinet FortiSandbox Web UI

This repository is a small standalone Python proof-of-concept/tester for a claimed Fortinet FortiSandbox vulnerability, CVE-2026-25089, described as a second-order OS command injection in a VNC start workflow. The repository contains 5 files: a README, license, gitignore, requirements.txt, and one main Python script, cve-2026-25089.py. The only executable logic is in that Python file, making it the clear entry point. The exploit script has two main capabilities. First, it can simulate the vulnerable behavior locally via vulnerable_command_simulator(), which constructs a shell command using attacker-controlled JSON fields and executes it with subprocess.run(..., shell=True). This is the core exploit behavior and demonstrates arbitrary command execution through the vm_name parameter. Second, it can send the crafted JSON payload to a remote HTTP endpoint using requests.post() in send_to_target(), allowing the user to test a FortiSandbox-like API endpoint. The script disables TLS verification and suppresses urllib3 insecure request warnings, which is common in lab-oriented exploit tooling. The exploit is operational rather than a mere detector because it includes an actual command-execution path in local simulation mode and a delivery mechanism for remote payload submission. However, it is still basic: there is no authentication handling, no target fingerprinting, no response parsing beyond status/body preview, and no advanced payload staging. Payload customization is limited to JSON input and a simple --cmd override that rewrites vm_name to include injected shell commands. Repository structure is minimal and educational in tone. README.md provides setup and usage examples, including local simulation and remote POST testing. requirements.txt lists only the requests dependency. There is no framework usage, no modularization, and no auxiliary exploit components. Overall, this is a compact standalone PoC/test harness intended to demonstrate and exercise an HTTP-delivered OS command injection scenario against a FortiSandbox-like VNC start API.