Cary Hooper

5 exploits Active since Mar 2020
CVE-2020-8635 GITHUB HIGH c WORKING POC
Wing FTP Server <6.2.3 - Privilege Escalation
Wing FTP Server v6.2.3 for Linux, macOS, and Solaris sets insecure permissions on installation directories and configuration files. This allows local users to arbitrarily create FTP users with full privileges, and escalate privileges within the operating system by modifying system files.
4 stars
CVSS 7.8
CVE-2020-8635 NOMISEC HIGH WORKING POC
Wing FTP Server <6.2.3 - Privilege Escalation
Wing FTP Server v6.2.3 for Linux, macOS, and Solaris sets insecure permissions on installation directories and configuration files. This allows local users to arbitrarily create FTP users with full privileges, and escalate privileges within the operating system by modifying system files.
1 stars
CVSS 7.8
CVE-2020-9470 NOMISEC HIGH WORKING POC
Wing FTP Server < 6.2.5 - Session Cookie Exposure via Insecure Directory Permissions
An issue was discovered in Wing FTP Server 6.2.5 before February 2020. Due to insecure permissions when handling session cookies, a local user may view the contents of the session and session_admin directories, which expose active session cookies within the Wing FTP HTTP interface and administration panel. These cookies may be used to hijack user and administrative sessions, including the ability to execute Lua commands as root within the administration panel.
CVSS 7.8
EIP-2026-118121 EXPLOITDB python WORKING POC
Wing FTP Server 6.2.3 - Privilege Escalation
EIP-2026-104492 EXPLOITDB bash WORKING POC
Wing FTP Server 6.2.5 - Privilege Escalation