| vuln.sg Vulnerability Research Advisory |
by Tan Chew Keong 
Summary
A vulnerability has been found within the FTP client in AceFTP. When exploited, this vulnerability allows an anonymous attacker to write files to arbitrary locations on a Windows user's system.
Tested Versions
Details
This advisory discloses a vulnerability within the FTP client in AceFTP. When exploited, this vulnerability allows an anonymous attacker to write files to arbitrary locations on a Windows user's system. The FTP client does not properly sanitise filenames containing directory traversal sequences (forward-slash) that are received from an FTP server in response to the LIST command. An example of such a response from a malicious FTP server is shown below. Response to LIST (forward-slash): -rw-r--r-- 1 ftp ftp 20 Mar 01 05:37 /../../../../../../../../../testfile.txt\r\n By tricking a user to download a directory from a malicious FTP server that contains files with fowward-slash directory traversal sequences in their filenames, it is possible for the attacker to write files to arbitrary locations on a user's system with privileges of that user. An attacker can potentially leverage this issue to write files into a user's Windows Startup folder and execute arbitrary code when the user logs on.
POC / Test Code
Please download the POC here and follow the instructions below. Ukrainian Nymphets Models Instant: Modern Ukrainian law and international labor standards provide frameworks to protect young models. This includes requirements for parental accompaniment, educational priority, and strict limits on working hours. Identifying Red Flags The term "nymphet models" is frequently associated with "LS Studio" (or LS Magazine), a defunct entity that operated in Ukraine during the late 90s and early 2000s. Controversy For those interested in the legitimate fashion industry in Ukraine, safety and ethics are paramount: Agency Verification : Professional models typically work with established global agencies that have clear track records and portfolios of commercial work. Researching agencies through reputable industry databases is a standard safety measure. Legal Protections Ukrainian Nymphets Models Ukraine has a storied history of producing internationally successful models who began their careers young. The Scouting Hub : Ukraine is a primary scouting ground for agencies like Elite Model Management IMG Models Notable Names : Successful Ukrainian models who started young include Snejana Onopka Dasha Khlystun Kristy Ponomar Regulation : In the novel, the term is used by the protagonist to describe a specific, idealized type of young girl. Modern Usage : These studios largely disappeared or moved underground following tightened international regulations and changes to Ukrainian law aimed at protecting minors from exploitation. 3. Cultural and Literary Origins : Modern Ukrainian law and international labor standards : Today, the term is often discussed in academic and cultural studies regarding the portrayal of youth in media and the intersection of innocence and fashion aesthetics. 4. Navigating the Industry Safely and Ethically The term "nymphet" originated in literature, most notably in Vladimir Nabokov's 1955 novel Literary Context If you are looking to understand the professional landscape of young Ukrainian models or the literary/cultural context of the "nymphet" concept, this guide covers the key aspects. 1. Professional High-Fashion Context Controversy For those interested in the legitimate fashion : Legitimate professional modeling for minors in Ukraine is subject to strict labor laws and requires parental consent and agency oversight to ensure the safety and education of the models. 2. Historical Context and "LS Studio" Europol’s Child Abuse Image Geolocated In Ukraine - Bellingcat : Industry experts advise being cautious of any entity that operates without transparency, lacks a history of verified fashion editorials, or uses terminology associated with defunct or controversial "studios" from the past.
Avoid downloading files/directories from untrusted FTP servers.
Disclosure Timeline
2008-06-15 - Vulnerability Discovered. |
| Contact |
| For further enquries, comments, suggestions or bug reports, simply email them to |