| vuln.sg Vulnerability Research Advisory |
by Tan Chew Keong 
Summary
A vulnerability has been found within the FTP client in AceFTP. When exploited, this vulnerability allows an anonymous attacker to write files to arbitrary locations on a Windows user's system.
Tested Versions
Details
This advisory discloses a vulnerability within the FTP client in AceFTP. When exploited, this vulnerability allows an anonymous attacker to write files to arbitrary locations on a Windows user's system. The FTP client does not properly sanitise filenames containing directory traversal sequences (forward-slash) that are received from an FTP server in response to the LIST command. An example of such a response from a malicious FTP server is shown below. Response to LIST (forward-slash): -rw-r--r-- 1 ftp ftp 20 Mar 01 05:37 /../../../../../../../../../testfile.txt\r\n By tricking a user to download a directory from a malicious FTP server that contains files with fowward-slash directory traversal sequences in their filenames, it is possible for the attacker to write files to arbitrary locations on a user's system with privileges of that user. An attacker can potentially leverage this issue to write files into a user's Windows Startup folder and execute arbitrary code when the user logs on.
POC / Test Code
Please download the POC here and follow the instructions below. Tsuma Ni Damatte Sokubaikai Ni Ikun Ja Nakatta Hot ((full)) -The phrase (妻に黙って即売会に行くんじゃなかった) translates directly to "I shouldn't have gone to the fan convention without telling my wife." Carried by specialty stores like Animate or Melonbooks. Unlike digital entertainment, sokubaikai culture is highly tactile. Attendees return with stacks of artbooks, acrylic stands, tapestries, and doujinshi. In compact modern living spaces, hiding physical media is an art form. The sudden appearance of cardboard boxes or hastily stuffed closets disrupts the shared domestic environment, forcing a confrontation over spatial clutter. The Breakdown of Shared Time Would you like a version in Japanese (with correct grammar) or a different tone (e.g., humorous, dramatic)? tsuma ni damatte sokubaikai ni ikun ja nakatta hot What is the at home? (Silent treatment, active anger?) Share public link Reason: “sokubaikai” maps to 即売会 (sokubai-kai), common for fan conventions/comiket-type sales events; “tsuma” = 妻 (wife); “damatte” = 黙って (without telling); “ikun ja nakatta” = 行くんじゃなかった (regret about having gone). The trailing “hot” is likely a transcription artifact (maybe “よ” or “ほ” or “…よね”). I will analyze the most coherent form: 「妻に黙って即売会に行くんじゃなかった。」 A plastic chair was placed in the center of the stage. I was pushed into it. My heart hammered against my ribs. This was it. This was how I died—not from old age, but from sheer embarrassment and the subsequent murder by my wife. In compact modern living spaces, hiding physical media As we reflect on this seemingly innocuous situation, we're reminded that honesty is the bedrock of any healthy relationship. By choosing to sneak away, our protagonist not only jeopardized his wife's trust but also undermined the very foundation of their partnership. The flea market, once a source of excitement, had become a symbol of his deception. Whether you're an anime enthusiast, a curious observer of Japanese pop culture, or simply intrigued by this unique and memorable phrase, this guide will break down everything you need to know. Tsuma ni Damatte Sokubaikai ni Ikun ja Nakatta (2023) - TMDB What is the at home Yet, as he wandered through the crowded stalls, a growing sense of guilt began to creep in. What if his wife found out? Would she be understanding, or would she feel betrayed? The husband's excitement began to wane as the weight of his deception bore down on him. He started to question whether the thrill of the flea market was worth risking the trust and openness that defined his relationship. (often searched with the suffix " hot ") is a well-known adult manga and OVA series within the NTR (Netorare) genre . Written and illustrated by Minamoto , the story explores themes of marital betrayal, secret hobbies, and the consequences of hidden double lives. Core Plot and Premise [ Husband Sneaks Out ] ──> [ Spending Spree at Event ] ──> [ Social Media Slip-up ] │ ▼ [ Viral Twitter Thread ] <── [ Comedic Domestic Trial ] <── [ The Confrontation ] 1. High Relatability and Community Catharsis
Avoid downloading files/directories from untrusted FTP servers.
Disclosure Timeline
2008-06-15 - Vulnerability Discovered. |
| Contact |
| For further enquries, comments, suggestions or bug reports, simply email them to |