1 result · Feed
-
Unscored —
FTP command injection via CRLF in control channel arguments
Affected versions of `suppaftp` wrote command arguments (user name, password, paths, `SITE` arguments and custom commands) to the FTP control channel without validation. An argument containing a carriage return (`\r`) or a line feed (`\n`) terminated the inte…