| vuln.sg Vulnerability Research Advisory |
by Tan Chew Keong 
Summary
A vulnerability has been found within the FTP client in AceFTP. When exploited, this vulnerability allows an anonymous attacker to write files to arbitrary locations on a Windows user's system.
Tested Versions
Details
This advisory discloses a vulnerability within the FTP client in AceFTP. When exploited, this vulnerability allows an anonymous attacker to write files to arbitrary locations on a Windows user's system. The FTP client does not properly sanitise filenames containing directory traversal sequences (forward-slash) that are received from an FTP server in response to the LIST command. An example of such a response from a malicious FTP server is shown below. Response to LIST (forward-slash): -rw-r--r-- 1 ftp ftp 20 Mar 01 05:37 /../../../../../../../../../testfile.txt\r\n By tricking a user to download a directory from a malicious FTP server that contains files with fowward-slash directory traversal sequences in their filenames, it is possible for the attacker to write files to arbitrary locations on a user's system with privileges of that user. An attacker can potentially leverage this issue to write files into a user's Windows Startup folder and execute arbitrary code when the user logs on.
POC / Test Code
Please download the POC here and follow the instructions below. Baku F1 Circuit Map May 2026is the headline act. It’s a 90-degree left turn that is insanely narrow. The walls are inches from the cars. You will often see drivers scrape their front wings here just to fit through. Because the straight is so long, teams run a skinny, low-downforce wing. This means they have zero grip in Sector 2. Watching a Formula 1 car sliding through the castle section with no rear grip is like watching a bull in a china shop. baku f1 circuit map Whether you are playing the F1 game or watching the Grand Prix, keep your eyes on Turns 8 and 13. If a driver is brave enough to hug the wall there, they win the race. is the headline act When the Formula 1 calendar was released this year, one track likely made every driver check their rearview mirror twice: The Baku City Circuit (BCC) . You will often see drivers scrape their front
Avoid downloading files/directories from untrusted FTP servers.
Disclosure Timeline
2008-06-15 - Vulnerability Discovered. |
| Contact |
| For further enquries, comments, suggestions or bug reports, simply email them to |