| vuln.sg Vulnerability Research Advisory |
by Tan Chew Keong 
Summary
A vulnerability has been found within the FTP client in AceFTP. When exploited, this vulnerability allows an anonymous attacker to write files to arbitrary locations on a Windows user's system.
Tested Versions
Details
This advisory discloses a vulnerability within the FTP client in AceFTP. When exploited, this vulnerability allows an anonymous attacker to write files to arbitrary locations on a Windows user's system. The FTP client does not properly sanitise filenames containing directory traversal sequences (forward-slash) that are received from an FTP server in response to the LIST command. An example of such a response from a malicious FTP server is shown below. Response to LIST (forward-slash): -rw-r--r-- 1 ftp ftp 20 Mar 01 05:37 /../../../../../../../../../testfile.txt\r\n By tricking a user to download a directory from a malicious FTP server that contains files with fowward-slash directory traversal sequences in their filenames, it is possible for the attacker to write files to arbitrary locations on a user's system with privileges of that user. An attacker can potentially leverage this issue to write files into a user's Windows Startup folder and execute arbitrary code when the user logs on.
POC / Test Code
Please download the POC here and follow the instructions below. Lud Zbunjen Normalan English Subtitles -The banter between Izet and his neighbors requires rapid translation. Finding high-quality English subtitles for cult-classic regional television shows can be a challenging task. (Crazy, Confused, Normal) stands as one of the most successful sitcoms in the history of Balkan television. The Bosnian series, created by Feđa Isović, follows three generations of the Fazlinović family living under one roof in Sarajevo. For international viewers and diaspora members who are not fluent in the local languages, finding reliable English subtitles is essential to enjoying the show's sharp political satire, physical comedy, and cultural nuances. Where to Find English Subtitles for Lud, Zbunjen, Normalan lud zbunjen normalan english subtitles For tech-savvy viewers, you can download the episodes and use a media player like BS.Player or VLC. These players can sometimes automatically search for and load community-made English subtitle files (.srt) from external databases. Show Overview: The "Fazlinović" Dynamic The banter between Izet and his neighbors requires : Users frequently discuss where to find subtitles for Balkan shows; checking these threads can lead to direct links for .srt files. individual episode title to narrow down your search? The Bosnian series, created by Feđa Isović, follows If you are interested, I can help you locate specific, popular episodes to start with or provide a guide on how to add subtitle files to your media player. Lud, Zbunjen, Normalan is a popular Bosnian sitcom documenting the chaotic lives of three generations of the Fazlinović family in Sarajevo, serving as a cultural touchstone for the Balkan diaspora. Demand for English subtitles has fueled community-driven efforts on platforms like YouTube and Subscene to bridge the language gap caused by rapid-fire slang and complex regional humor. Bosnian idioms translated literally sound bizarre in English. Good fansubs use localized English idioms instead. How to Set Up External English Subtitles
Avoid downloading files/directories from untrusted FTP servers.
Disclosure Timeline
2008-06-15 - Vulnerability Discovered. |
| Contact |
| For further enquries, comments, suggestions or bug reports, simply email them to |