| vuln.sg Vulnerability Research Advisory |
by Tan Chew Keong 
Summary
A vulnerability has been found within the FTP client in AceFTP. When exploited, this vulnerability allows an anonymous attacker to write files to arbitrary locations on a Windows user's system.
Tested Versions
Details
This advisory discloses a vulnerability within the FTP client in AceFTP. When exploited, this vulnerability allows an anonymous attacker to write files to arbitrary locations on a Windows user's system. The FTP client does not properly sanitise filenames containing directory traversal sequences (forward-slash) that are received from an FTP server in response to the LIST command. An example of such a response from a malicious FTP server is shown below. Response to LIST (forward-slash): -rw-r--r-- 1 ftp ftp 20 Mar 01 05:37 /../../../../../../../../../testfile.txt\r\n By tricking a user to download a directory from a malicious FTP server that contains files with fowward-slash directory traversal sequences in their filenames, it is possible for the attacker to write files to arbitrary locations on a user's system with privileges of that user. An attacker can potentially leverage this issue to write files into a user's Windows Startup folder and execute arbitrary code when the user logs on.
POC / Test Code
Please download the POC here and follow the instructions below. Heydouga 4017 Ppv214 Mayu 1 !new! Jun 2026HeyDouga is a Japanese adult video (AV) production company that has been active in the industry for many years. Known for its diverse range of content, HeyDouga caters to various tastes and preferences, from mainstream erotic videos to more niche and specialized content. The company has built a reputation for producing high-quality videos, often featuring a mix of established stars and newcomers to the industry. Mayu, the performer featured in "HeyDouga 4017 PPV214 Mayu 1," is an individual who has captured the attention of fans within the Japanese adult entertainment industry. Performers in this industry often have a dedicated following, with their fans appreciating them for various qualities, including their looks, talent, and on-screen presence. Mayu, like many performers, brings a unique set of attributes to her work, contributing to her popularity among viewers. heydouga 4017 ppv214 mayu 1
Avoid downloading files/directories from untrusted FTP servers.
Disclosure Timeline
2008-06-15 - Vulnerability Discovered. |
| Contact |
| For further enquries, comments, suggestions or bug reports, simply email them to |