🧪 Exploit Description:

When a user try to login it calls the c_CheckUser call which always returns OK_CHECK_CONNECTION regardless of what comes after the NULL byte in the username, as long as the string before the NULL byte matches an existing user. An attacker may exploit the vulnerability by adding a NULL byte and extra values to a known username to bypass the password check. The system uses strlen() on our username to get the string size, but strlen only counts all the characters until it reaches the NULL-byte terminator to match the unsanitized username.

The unsanitized username (including the injected NULL and brainy payload) is stored directly into session files as Lua code. These session files resemble .lua and are later executed when sessions are loaded. On Linux, Wing FTP server runs as root; on Windows, it runs as SYSTEM. The injected Lua payload runs with full privileges upon session reload.

Note : This behaviour is only happening if the password is not set or with a valid credentials. It enforcing some strict password validation if password is set for the user.

⚒️ Install:

Options:

Usage:

🎯 Exploitation:

CVE-2025-47812 - Wing FTP Server Unauthenticated RCE

CVE-2025-47812 - Wing FTP Server authenticated RCE (dev-test:test)

Example usage:

🛡️ Remediation:

• Users must upgrade to WingFTP version 7.4.4 to patch the vulnerability.

• Please refer to the WingFTP Release Notes for more information.

📜 Reference & Credit:

• Original Exploit Author: Sheikh Mohammad Hasan aka 4m3rr0r

• Qualys

• Exploit

Note : I used the above reference for research purpose and updated the exploit with more fetures and robust error handling.

⚖️ License:

This Python PoC is released under the MIT License. The original exploit concept and disclosure credit belong to the Stratascale Cyber Research Unit.