CVE-2025-47812 — Wing FTP Server <= 7.4.3 Unauthenticated RCE (PoC)

Unauthenticated remote code execution vulnerability in Wing FTP Server <= 7.4.3. A NULL byte injected into the username parameter during login causes Lua code to be written into the session file. When /dir.html is accessed with the resulting session cookie, the injected code is executed — as root on Linux or SYSTEM on Windows.

---

How it works

1. A crafted POST to /loginok.html injects a NULL byte followed by Lua code into the username field.
2. The server creates a session file containing the unsanitized username (including the Lua payload).
3. A GET request to /dir.html with the returned UID cookie triggers execution of the injected Lua code.
4. The script logs out between commands to avoid hitting the server's concurrent session limit.

Requirements