CVE-2025-47812 – Wing FTP Server RCE Exploit

Exploit Title: Wing FTP Server < 7.4.4 Remote Code Execution via Lua Injection
CVE: CVE-2025-47812
Tested on: Wing FTP Server v7.3.x (Windows/Linux)
Impact: Remote Code Execution (RCE) as SYSTEM/root
Severity: Critical

Description

A vulnerability in Wing FTP Server's handling of \0 (null byte) in login input allows an attacker to inject arbitrary Lua code into session files via the user or admin web interface. This can be leveraged to execute system commands on the underlying OS.

• Works unauthenticated if anonymous login is enabled.
• Lua injection is triggered via the username parameter.
• Command output is extracted from dir.html using leaked UID.

Features

• Remote command execution
• Interactive shell (-i)
• Anonymous access support
• Proxy support (--proxy)
• Custom credentials
• Clean, readable output

Usage

python3 wingftp_cve_2025_47812.py [-h] [-u URL] [--list LIST] [-c COMMAND] [-U USERNAME] [-P PASSWORD] [--proxy PROXY] [-v] [-i]

Example:

python3 wingftp_cve_2025_47812.py -u "http://192.168.1.10" -c "whoami" -U anonymous -P password --proxy "http://127.0.0.1:8080" -v -i

Request/Response:

⚠️ Disclaimer

This exploit script is provided for educational purposes and authorized testing only. Usage against systems without explicit permission is illegal and unethical.

Official Channels

• YouTube @rootctf
• X @r0otk3r