| vuln.sg Vulnerability Research Advisory |
by Tan Chew Keong 
Summary
A vulnerability has been found within the FTP client in AceFTP. When exploited, this vulnerability allows an anonymous attacker to write files to arbitrary locations on a Windows user's system.
Tested Versions
Details
This advisory discloses a vulnerability within the FTP client in AceFTP. When exploited, this vulnerability allows an anonymous attacker to write files to arbitrary locations on a Windows user's system. The FTP client does not properly sanitise filenames containing directory traversal sequences (forward-slash) that are received from an FTP server in response to the LIST command. An example of such a response from a malicious FTP server is shown below. Response to LIST (forward-slash): -rw-r--r-- 1 ftp ftp 20 Mar 01 05:37 /../../../../../../../../../testfile.txt\r\n By tricking a user to download a directory from a malicious FTP server that contains files with fowward-slash directory traversal sequences in their filenames, it is possible for the attacker to write files to arbitrary locations on a user's system with privileges of that user. An attacker can potentially leverage this issue to write files into a user's Windows Startup folder and execute arbitrary code when the user logs on.
POC / Test Code
Please download the POC here and follow the instructions below. Hiraizerdгјеџ Ne Kadar Acд±yor Yгјreдџim Mp3 Д°ndir Dinle Mp3 Д°ndir Dur May 2026"Böyle daha ne kadar dayanabilirim?" 🥀Sometimes words aren't enough to explain the weight in our hearts, so we let the music speak for us. Hirai Zerdüş ’ün en dokunaklı eserlerinden biri olan "Ne Kadar Acıyor Yüreğim" her dinleyişte bambaşka bir yaraya dokunuyor. 🖤 How does this song make you feel? 👇 It’s one of those tracks that settles deep in your soul from the first note. One of his best works since its release in May 2022. Check it out on Spotify or YouTube ! 🎧✨ #HiraiZerdüş #NewMusic #TurkishFolk #MusicRecommendation "Böyle daha ne kadar dayanabilirim If you're looking for a post to share about this emotional track, here are a few options depending on where you're posting. (real name Hakan Bozdağ ) is known for his deep, soul-stirring folk music. His song "Ne Kadar Acıyor Yüreğim" is a raw exploration of heartbreak and longing. 👇 It’s one of those tracks that settles "Sensiz bu dünyada bir cehennemdeyim... Söyle, senden başka kimim var ki benim?" "Sensiz bu dünyada bir cehennemdeyim... Söyle
Avoid downloading files/directories from untrusted FTP servers.
Disclosure Timeline
2008-06-15 - Vulnerability Discovered. |
| Contact |
| For further enquries, comments, suggestions or bug reports, simply email them to |