Severity by source
AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H
Pre-auth username reaches the injection so PR:N/AV:N; AC:H because RCE needs non-default %U logging plus a command-capable SQL backend; total impact gives C/I/A:H.
Primary rating from Vendor (mitre).
CVSS VectorVendor: mitre
CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H
Lifecycle Timeline
3DescriptionCVE.org
mod_sql in ProFTPD before 1.3.10rc1 allows remote attackers to execute arbitrary code via a username, in scenarios where there is logging of USER requests with an expansion such as %U, and the SQL backend allows commands (e.g., COPY TO PROGRAM).
AnalysisAI
SQL injection escalating to remote code execution in ProFTPD's mod_sql before 1.3.10rc1 lets remote attackers inject SQL through the FTP USER (username) value, which is pre-authentication user-controlled data. Exploitation requires a deployment that logs USER requests via an expansion like %U and a SQL backend that permits command execution primitives (e.g. PostgreSQL COPY TO PROGRAM), turning the injection into arbitrary command execution on the host. A public proof-of-concept exists (ZeroPathAI), but there is no public exploit identified as actively used in the wild and it is not on CISA KEV; EPSS is low at 0.24%.
Technical ContextAI
ProFTPD is a widely deployed open-source FTP daemon, and mod_sql is its module for authenticating users and logging events against a SQL backend (MySQL, PostgreSQL, SQLite via mod_sql_* sub-modules). The root cause is CWE-89 (improper neutralization of SQL syntax): when the server is configured to log USER requests using a variable expansion such as %U, the attacker-supplied username is interpolated into a SQL statement without adequate sanitization. Because the username is accepted before authentication completes, the injection is reachable by any remote client. The escalation from data-layer injection to RCE depends on the backend exposing a command-execution sink - the canonical example being PostgreSQL's COPY ... TO PROGRAM, which runs shell commands under the database service account. The CPE cpe:2.3:a:proftpd:proftpd:*:*:*:*:*:*:*:* confirms the affected component is ProFTPD itself (all versions prior to the fix).
RemediationAI
Apply the vendor fix by upgrading to ProFTPD 1.3.10rc1 or later (Vendor-released patch: 1.3.10rc1), per http://www.proftpd.org/docs/RELEASE_NOTES-1.3.10rc1. If immediate upgrade is not possible, remove or alter mod_sql logging directives that expand the raw username (avoid %U in SQLLog/SQLNamedQuery INSERT logging paths) so attacker-controlled usernames are not interpolated into SQL. As a defense-in-depth measure, revoke command-execution capability from the database role ProFTPD uses - for PostgreSQL, ensure the login role is not a superuser and cannot run COPY TO PROGRAM, which breaks the RCE escalation even if injection occurs (trade-off: none for FTP function, since ProFTPD does not need superuser). Restricting network exposure of the FTP service to trusted ranges further reduces reachable attack surface. Reference the upstream issue https://github.com/proftpd/proftpd/issues/2052 and the oss-security disclosure at http://www.openwall.com/lists/oss-security/2026/05/01/4 for details.
The mod_copy module in ProFTPD 1.3.5 allows remote attackers to read and write to arbitrary files via the site cpfr and
The SSH transport protocol with certain OpenSSH extensions, found in OpenSSH before 9.6 and other products, allows remot
An arbitrary file copy vulnerability in mod_copy in ProFTPD up to 1.3.5b allows for remote code execution and informatio
SQL injection in ProFTPD 1.3.9a and earlier allows remote attackers to execute arbitrary SQL commands when the 'UseRever
make_ftp_cmd in main.c in ProFTPD before 1.3.8a has a one-byte out-of-bounds read, and daemon crash, because of mishandl
ProFTPD before 1.3.6b and 1.3.7rc before 1.3.7rc2 allows remote unauthenticated denial-of-service due to incorrect handl
Integer overflow in kbdint.c in mod_sftp in ProFTPD 1.3.4d and 1.3.5r3 allows remote attackers to cause a denial of serv
In ProFTPD 1.3.7, it is possible to corrupt the memory pool by interrupting the data transfer channel. Rated high severi
Arbitrary code execution in ProFTPD's mod_sftp module (versions before 1.3.9c and 1.3.10rc3) allows authenticated low-pr
Directory ACL bypass in ProFTPD (through 1.3.9b and 1.3.10rc2) lets authenticated FTP users reach files inside DenyAll-p
Authenticated remote denial of service in ProFTPD's mod_sftp module allows any user with valid SFTP credentials to crash
The mod_tls module in ProFTPD before 1.3.5b and 1.3.6 before 1.3.6rc2 does not properly handle the TLSDHParamFile direct
Same weakness CWE-89 – SQL Injection
View allVendor StatusVendor
SUSE
Severity: High| Product | Status |
|---|---|
| SUSE Linux Enterprise High Performance Computing 15 SP7 | Fixed |
| SUSE Linux Enterprise Module for Server Applications 15 SP7 | Fixed |
| SUSE Linux Enterprise Server 15 SP7 | Fixed |
| SUSE Linux Enterprise Server for SAP Applications 15 SP7 | Fixed |
| SUSE Linux Enterprise Module for Server Applications 15 SP6 | Fixed |
| SUSE Linux Enterprise Server 15 SP6 | Fixed |
| SUSE Linux Enterprise Server 15 SP6-LTSS | Fixed |
| SUSE Linux Enterprise Server for SAP Applications 15 SP6 | Fixed |
| SUSE Linux Enterprise High Performance Computing 15 SP6 | Fixed |
| openSUSE Leap 15.6 | Fixed |
Share
External POC / Exploit Code
Leaving vuln.today