Skip to content
KitploitKITPLOIT
ToolsBlog
Submit
ToolsBlog
Submit

Hacking, PenTest, and Cybersecurity Tools for Your Security Arsenal!

Kitploit is a directory of hacking, cybersecurity, and pentesting tools. Discover the latest project updates to find vulnerabilities, analyze systems, automate testing, and strengthen your security.

··Feeds·Contact·Privacy·© 2026 Kitploit

Tool Directory

Categories

View all categories
Loading categories
CVE-2025-47812 — Wing FTP Server RCE via Lua Injection | Kitploit
Tools/GitHubGitHub/0xgh057r3c0n/cve-2025-47812
Vulnerability AnalysisExploitationWeb Application ExploitationPenetration TestingRed TeamingPayload Development
GitHub0xgh057r3c0n/cve-2025-47812

CVE-2025-47812

Wing FTP Server RCE via Lua Injection

View Repository
3141 year agoNot yet reviewed

Most Popular

View all →

Discover the most used tools by our community.

Explore all tools

Browse our collection of tools

View all tools →
Share

CVE-2025-47812 – Wing FTP Server RCE via Lua Injection

Author: 0xgh057r3c0n

🧠 Description

This exploit leverages a Lua injection vulnerability in Wing FTP Server's login handler (loginok.html) to execute arbitrary operating system commands or gain a reverse shell. It abuses unsanitized Lua code execution through the username parameter.

📦 Requirements

  • Python 3.6 or higher
  • pip3

Python Packages

Install the required packages with:

root@kitploit:~
pip3 install -r requirements.txt
Download Tool

Or manually:

root@kitploit:~
pip3 install requests colorama

🛠️ Installation

root@kitploit:~
git clone https://github.com/0xgh057r3c0n/CVE-2025-47812.git
cd CVE-2025-47812
python3 CVE-2025-47812.py

🚀 Usage

Run the script:

root@kitploit:~
python3 CVE-2025-47812.py

Options:

  • Option 1: Execute a system command (e.g., whoami, id)
  • Option 2: Launch a reverse shell (multiple payload options included)

💡 Example

root@kitploit:~
Target URL (e.g., http://localhost:5466): http://192.168.1.100:5466
Username (e.g., anonymous): anonymous
Your choice (1 or 2): 1
Command to execute (default: whoami): whoami

⚠️ Legal Disclaimer

This tool is provided for educational and authorized security testing purposes only. You are responsible for your actions. Use only on systems you own or are authorized to test.

📄 License

This project is licensed under the MIT License. See the LICENSE file for details.