## https://sploitus.com/exploit?id=03DF3B79-B605-5484-AB52-03E7337F8BFE
# CVE-2025-47812 โ Wing FTP Server RCE via Lua Injection
**Author:** [0xgh057r3c0n](https://github.com/0xgh057r3c0n)
---
## ๐ง Description
This exploit leverages a Lua injection vulnerability in **Wing FTP Server**'s login handler (`loginok.html`) to execute arbitrary operating system commands or gain a reverse shell. It abuses unsanitized Lua code execution through the `username` parameter.
---
## ๐ฆ Requirements
- Python 3.6 or higher
- `pip3`
### Python Packages
Install the required packages with:
```bash
pip3 install -r requirements.txt
````
Or manually:
```bash
pip3 install requests colorama
```
---
## ๐ ๏ธ Installation
```bash
git clone https://github.com/0xgh057r3c0n/CVE-2025-47812.git
cd CVE-2025-47812
python3 CVE-2025-47812.py
```
---
## ๐ Usage
Run the script:
```bash
python3 CVE-2025-47812.py
```
### Options:
* **Option 1:** Execute a system command (e.g., `whoami`, `id`)
* **Option 2:** Launch a reverse shell (multiple payload options included)
---
## ๐ก Example
```text
Target URL (e.g., http://localhost:5466): http://192.168.1.100:5466
Username (e.g., anonymous): anonymous
Your choice (1 or 2): 1
Command to execute (default: whoami): whoami
```
---
## โ ๏ธ Legal Disclaimer
This tool is provided for **educational and authorized security testing purposes only**.
You are responsible for your actions. Use only on systems you own or are authorized to test.
---
## ๐ License
This project is licensed under the MIT License. See the [LICENSE](LICENSE) file for details.