| vuln.sg Vulnerability Research Advisory |
by Tan Chew Keong 
Summary
A vulnerability has been found within the FTP client in AceFTP. When exploited, this vulnerability allows an anonymous attacker to write files to arbitrary locations on a Windows user's system.
Tested Versions
Details
This advisory discloses a vulnerability within the FTP client in AceFTP. When exploited, this vulnerability allows an anonymous attacker to write files to arbitrary locations on a Windows user's system. The FTP client does not properly sanitise filenames containing directory traversal sequences (forward-slash) that are received from an FTP server in response to the LIST command. An example of such a response from a malicious FTP server is shown below. Response to LIST (forward-slash): -rw-r--r-- 1 ftp ftp 20 Mar 01 05:37 /../../../../../../../../../testfile.txt\r\n By tricking a user to download a directory from a malicious FTP server that contains files with fowward-slash directory traversal sequences in their filenames, it is possible for the attacker to write files to arbitrary locations on a user's system with privileges of that user. An attacker can potentially leverage this issue to write files into a user's Windows Startup folder and execute arbitrary code when the user logs on.
POC / Test Code
Please download the POC here and follow the instructions below. Mahir Elnur Mexfi Here Oz Kefinde -The Unfading Vibe of "Hərə öz kefində": Why This Track Still Hits In the world of Azerbaijani pop and "Meykhana-style" hits, some songs are fleeting, while others manage to stay in the rotation for over a decade. One such track that has maintained its cool since its release is by Elnur Məxfi and Mahir . Mahir Elnur Mexfi Here Oz Kefinde : The chemistry between Mahir (often associated with the "Ay Brat" style) and Elnur Məxfi creates a balanced sound—one that is both smooth and street-smart. You can find more of their joint efforts on platforms like Spotify and Last.fm . The Unfading Vibe of "Hərə öz kefində": Why Whether you're cruising through the city or looking for that specific rhythmic pulse for your playlist, this song—which translates roughly to "Everyone is in their own mood" or "Mind your own business/pleasure"—remains a quintessential example of its genre. A Decade of Influence You can find more of their joint efforts "Hərə öz kefində" isn't just a song; it's a reminder to keep your head up and enjoy your own vibe, no matter what’s happening around you. : The title says it all. In a world where everyone is constantly under a microscope, "Hərə öz kefində" is an anthem for individuality and staying in your own lane. Originally gaining traction around 2013 , the track captured a specific cultural moment in the regional music scene. Elnur Məxfi, a prolific artist known for hits like "Məni Də Apar" and collaborations such as "Pərvanələrin Eşqinə" on his Official YouTube Channel , has a knack for blending catchy, repetitive hooks with the raw energy of urban life. Why It Resonates
Avoid downloading files/directories from untrusted FTP servers.
Disclosure Timeline
2008-06-15 - Vulnerability Discovered. |
| Contact |
| For further enquries, comments, suggestions or bug reports, simply email them to |