CVE-2008-2702
ESTsoft ALFTP 4.1 beta 2 and 5.0 - Path Traversal via FTP LIST Response
Title source: llmExploitation Summary
EIP tracks 1 public exploit for CVE-2008-2702. PoCs published by Tan Chew Keong.
AI-analyzed exploit summary This exploit demonstrates a directory traversal vulnerability in ALFTP, allowing an attacker to write arbitrary files outside the intended directory by manipulating the response to the LIST command with either backslashes or forward slashes.
Description
Directory traversal vulnerability in the FTP client in ALTools ESTsoft ALFTP 4.1 beta 2 and 5.0 allows remote FTP servers to create or overwrite arbitrary files via a .. (dot dot) in a response to a LIST command, a related issue to CVE-2002-1345. NOTE: this can be leveraged for code execution by writing to a Startup folder.
Exploits (1)
This exploit demonstrates a directory traversal vulnerability in ALFTP, allowing an attacker to write arbitrary files outside the intended directory by manipulating the response to the LIST command with either backslashes or forward slashes.