Listen to this Post
How CVE-2025-47812 Works
Wing FTP Server versions before 7.4.4 fail to properly sanitize ‘\0’ (null byte) characters in user and admin web interfaces. Attackers can exploit this flaw to inject malicious Lua code into user session files. When the server processes these manipulated session files, the injected Lua code executes with the privileges of the FTP service (typically root or SYSTEM). This vulnerability is remotely exploitable, even via anonymous FTP accounts, leading to full server compromise.
DailyCVE Form
Platform: Wing FTP Server
Version: < 7.4.4
Vulnerability: Lua Injection
Severity: Critical
Date: 07/15/2025
Prediction: Patch by 08/2025
What Undercode Say
curl -X POST -d "user=admin&session=\0malicious_lua" http://target/ftp_webui
-- Exploit payload example
os.execute("whoami > /tmp/compromised")
How Exploit
1. Send crafted session data with null byte.
2. Inject Lua code into session file.
3. Server executes payload with high privileges.
Protection from this CVE
1. Update to Wing FTP 7.4.4+.
2. Disable anonymous FTP.
3. Restrict server permissions.
Impact
- Remote Code Execution (RCE).
- Full system compromise.
- Bypasses authentication.
Sources:
Reported By: nvd.nist.gov
Extra Source Hub:
Undercode
