| vuln.sg Vulnerability Research Advisory |
by Tan Chew Keong 
Summary
A vulnerability has been found within the FTP client in AceFTP. When exploited, this vulnerability allows an anonymous attacker to write files to arbitrary locations on a Windows user's system.
Tested Versions
Details
This advisory discloses a vulnerability within the FTP client in AceFTP. When exploited, this vulnerability allows an anonymous attacker to write files to arbitrary locations on a Windows user's system. The FTP client does not properly sanitise filenames containing directory traversal sequences (forward-slash) that are received from an FTP server in response to the LIST command. An example of such a response from a malicious FTP server is shown below. Response to LIST (forward-slash): -rw-r--r-- 1 ftp ftp 20 Mar 01 05:37 /../../../../../../../../../testfile.txt\r\n By tricking a user to download a directory from a malicious FTP server that contains files with fowward-slash directory traversal sequences in their filenames, it is possible for the attacker to write files to arbitrary locations on a user's system with privileges of that user. An attacker can potentially leverage this issue to write files into a user's Windows Startup folder and execute arbitrary code when the user logs on.
POC / Test Code
Please download the POC here and follow the instructions below. Index Of Cannibal Holocaust 1980 (PLUS - 2025)Decades after its release, this foundational found-footage movie remains one of the most heavily censored, debated, and misunderstood pieces of cinema history. Understanding the film's context, the mechanics of digital film indexing, and its enduring impact helps explain why this specific search query remains highly active today. Understanding the Search: What is an "Index of"? Decades before The Blair Witch Project (1999) or Paranormal Activity (2007) popularized the format, Ruggero Deodato invented the . index of cannibal holocaust 1980 When users type this phrase into a search engine, they are specifically trying to locate a that contains a download link or a direct stream of the 1980 film. This is a tactic commonly used to bypass: Decades before The Blair Witch Project (1999) or : The film looked so real that Deodato was arrested and charged with murder in Italy. Authorities believed the on-screen deaths were actual "snuff" footage. Decades after its release While its shock value is undeniable, the film is also a savage critique of Western media sensationalism and the exploitative nature of journalism. It is often analyzed as a "film about filmmaking" that accuses its own audience of complicity in a hunger for violent spectacle. Cannibal Holocaust is not a film you simply watch; it’s a film you endure. Decades after its release, it remains one of the most controversial, reviled, and yet strangely essential works of exploitation cinema. To dismiss it outright as disgusting trash is to ignore its cunning subtext, but to praise it uncritically would be to excuse its very real ethical and animal cruelty violations.
Avoid downloading files/directories from untrusted FTP servers.
Disclosure Timeline
2008-06-15 - Vulnerability Discovered. |
| Contact |
| For further enquries, comments, suggestions or bug reports, simply email them to |