| vuln.sg Vulnerability Research Advisory |
by Tan Chew Keong 
Summary
A vulnerability has been found within the FTP client in AceFTP. When exploited, this vulnerability allows an anonymous attacker to write files to arbitrary locations on a Windows user's system.
Tested Versions
Details
This advisory discloses a vulnerability within the FTP client in AceFTP. When exploited, this vulnerability allows an anonymous attacker to write files to arbitrary locations on a Windows user's system. The FTP client does not properly sanitise filenames containing directory traversal sequences (forward-slash) that are received from an FTP server in response to the LIST command. An example of such a response from a malicious FTP server is shown below. Response to LIST (forward-slash): -rw-r--r-- 1 ftp ftp 20 Mar 01 05:37 /../../../../../../../../../testfile.txt\r\n By tricking a user to download a directory from a malicious FTP server that contains files with fowward-slash directory traversal sequences in their filenames, it is possible for the attacker to write files to arbitrary locations on a user's system with privileges of that user. An attacker can potentially leverage this issue to write files into a user's Windows Startup folder and execute arbitrary code when the user logs on.
POC / Test Code
Please download the POC here and follow the instructions below. Puri Sharma And Pathania Physical ChemistryHere are several specific feature ideas for a textbook or digital resource titled (assuming you’re looking to propose new editions, digital tools, or supplementary features): If you are a chemistry student in India, chances are you’ve spent some quality time with "Principles of Physical Chemistry" by Puri, Sharma, and Pathania (PSP). It has remained a staple on the bookshelves of undergraduates and postgraduates for decades. Why It’s a Classic The book is famous for its lucid language puri sharma and pathania physical chemistry Unlike introductory Western texts (like Atkins or Engel) that often simplify math to focus on concepts, Puri, Sharma, and Pathania (PSP) embrace the math. The derivation of every formula is step-by-step and thorough. This makes it exceptional for students who need to understand the "how" and "why" behind equations, which is crucial for postgraduate entrance exams. Here are several specific feature ideas for a | Topic | Rating | Comments | | :--- | :--- | :--- | | | ⭐⭐⭐⭐⭐ | Masterful. Covers fugacity, activity, and open systems beautifully. | | Solid State | ⭐⭐⭐⭐⭐ | The best available resource in this category for this level. | | Gaseous State | ⭐⭐⭐⭐ | Excellent coverage of real gases and virial equations. | | Electrochemistry | ⭐⭐⭐⭐ | Very strong on thermodynamic aspects (Debye-Hückel theory). | | Quantum Chemistry | ⭐⭐⭐ | Good for basics, but lacks the visual intuition of Levine or McQuarrie. | | Spectroscopy | ⭐⭐⭐ | The theory is there, but lacks modern instrumental application details. | | Polymer Chemistry | ⭐⭐⭐ | Adequate, but not the primary reason to buy this book. | The derivation of every formula is step-by-step and thorough
Avoid downloading files/directories from untrusted FTP servers.
Disclosure Timeline
2008-06-15 - Vulnerability Discovered. |
| Contact |
| For further enquries, comments, suggestions or bug reports, simply email them to |