| vuln.sg Vulnerability Research Advisory |
by Tan Chew Keong 
Summary
A vulnerability has been found within the FTP client in AceFTP. When exploited, this vulnerability allows an anonymous attacker to write files to arbitrary locations on a Windows user's system.
Tested Versions
Details
This advisory discloses a vulnerability within the FTP client in AceFTP. When exploited, this vulnerability allows an anonymous attacker to write files to arbitrary locations on a Windows user's system. The FTP client does not properly sanitise filenames containing directory traversal sequences (forward-slash) that are received from an FTP server in response to the LIST command. An example of such a response from a malicious FTP server is shown below. Response to LIST (forward-slash): -rw-r--r-- 1 ftp ftp 20 Mar 01 05:37 /../../../../../../../../../testfile.txt\r\n By tricking a user to download a directory from a malicious FTP server that contains files with fowward-slash directory traversal sequences in their filenames, it is possible for the attacker to write files to arbitrary locations on a user's system with privileges of that user. An attacker can potentially leverage this issue to write files into a user's Windows Startup folder and execute arbitrary code when the user logs on.
POC / Test Code
Please download the POC here and follow the instructions below. Petarda Padre E Hija DormidaHer father, moved to the point of calling her his "savior" during his darkest moments (referring to his separation and the death of his mother, Carmina Ordóñez), watched the video with a mix of joy and emotion. The phrase was simple, poetic, and deeply evocative of a universal father-daughter bond. It was the perfect "feel-good" viral moment. #DadLife #SiestaTime #Dormida #FatherDaughter #PaternidadReal Option 2: Short & Punchy (Great for Reels/TikTok) Audiences often view these clips through the lens of their own family dynamics, debating whether the prank crosses a line or remains harmless fun. Where Humor Meets Boundaries Since the daughter is asleep at the start of the video, she cannot consent to being filmed. Sharing these vulnerable moments on the public internet—where they may remain forever—is a growing concern for digital rights advocates. petarda padre e hija dormida Expresses concern over the physical danger of fireworks indoors. El auge de plataformas como TikTok, Instagram Reels y YouTube Shorts ha transformado la manera en que consumimos comedia. Búsquedas como "petarda padre e hija dormida" se vuelven populares por factores muy específicos: Es fundamental que los usuarios ejerzan un consumo responsable. Reportar videos que muestren conductas peligrosas, abuso infantil o uso negligente de explosivos es el primer paso para desincentivar que los creadores sigan arriesgando la salud de sus familias por conseguir visualizaciones. La seguridad, el respeto y la salud de nuestros seres queridos siempre deben estar por encima de cualquier tendencia viral. Her father, moved to the point of calling Para que un video de esta categoría funcione de manera positiva, se suelen cuidar ciertos aspectos: Some viewers find the "jump scare" nature of the prank funny, often praising the comedic timing or the genuine (and harmless) shock of the person being woken up. These comments usually focus on the family's dynamic and the "prankster" culture. Tana Rivera's video clip is a masterclass in modern celebrity. By publicly calling herself a "petarda" and sharing her father's term of endearment, she humanized herself and her famous bullfighting family. It made her relatable. The phrase became a shorthand for a playful, teasing father-daughter relationship. Expresses concern over the physical danger of fireworks A selfie of you looking exhausted but happy while she’s passed out on your shoulder or the couch. Music Idea: If you want to explore further, let me know if you want to look into , digital privacy laws for minors , or how to protect your device from malware when looking up viral trends. Share public link
Avoid downloading files/directories from untrusted FTP servers.
Disclosure Timeline
2008-06-15 - Vulnerability Discovered. |
| Contact |
| For further enquries, comments, suggestions or bug reports, simply email them to |