| vuln.sg Vulnerability Research Advisory |
by Tan Chew Keong 
Summary
A vulnerability has been found within the FTP client in AceFTP. When exploited, this vulnerability allows an anonymous attacker to write files to arbitrary locations on a Windows user's system.
Tested Versions
Details
This advisory discloses a vulnerability within the FTP client in AceFTP. When exploited, this vulnerability allows an anonymous attacker to write files to arbitrary locations on a Windows user's system. The FTP client does not properly sanitise filenames containing directory traversal sequences (forward-slash) that are received from an FTP server in response to the LIST command. An example of such a response from a malicious FTP server is shown below. Response to LIST (forward-slash): -rw-r--r-- 1 ftp ftp 20 Mar 01 05:37 /../../../../../../../../../testfile.txt\r\n By tricking a user to download a directory from a malicious FTP server that contains files with fowward-slash directory traversal sequences in their filenames, it is possible for the attacker to write files to arbitrary locations on a user's system with privileges of that user. An attacker can potentially leverage this issue to write files into a user's Windows Startup folder and execute arbitrary code when the user logs on.
POC / Test Code
Please download the POC here and follow the instructions below. Busywin 14 Rel 2.0 Crack //top\\ -When searching for software utilities, accounting tools, or business management programs like Busy Win 14 Release 2.0, you might encounter websites offering cracked versions, keygens, or activation patches. While the idea of accessing premium software for free is tempting, using a cracked version introduces severe risks to your data, computer security, and business operations. BusyWin is a popular software used for managing and automating tasks, particularly in industrial and commercial settings. The latest iteration, BusyWin 14 Rel 2.0, has garnered significant attention, with some users seeking out cracked versions. In this feature, we'll explore what BusyWin 14 Rel 2.0 offers, the implications of using cracked software, and provide insights into the software's genuine value. busywin 14 rel 2.0 crack This public link is valid for 7 days and shares a thread, including any personal information you added. This link or copies made by others cannot be deleted. If you share with third parties, their policies apply. Can’t copy the link right now. Try again later. When searching for software utilities, accounting tools, or During its peak, BUSY 14 users often encountered "soft-lock" errors where security dongles or software licenses would fail due to antivirus interference—a common reason users originally sought "cracks" or workarounds. Why "Cracks" are a Risk The latest iteration, BusyWin 14 Rel 2 : The official Busy Resources page provides all necessary utilities and updated software versions legally. The search for "Busywin 14 Rel 2.0 crack" leads back to the history of , a popular GST-ready financial and inventory management tool primarily used in India.
Avoid downloading files/directories from untrusted FTP servers.
Disclosure Timeline
2008-06-15 - Vulnerability Discovered. |
| Contact |
| For further enquries, comments, suggestions or bug reports, simply email them to |