EUVD-2026-27484
GHSA-jmg2-v72j-gmvc
Severity by source
AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H
Primary rating from Vendor (mitre).
CVSS VectorVendor: mitre
Lifecycle Timeline
2DescriptionCVE.org
In ProFTPD through 1.3.9a before 7666224, a SQL injection vulnerability in sqltab_fetch_clients_cb() in contrib/mod_wrap2_sql.c allows a remote attacker to inject arbitrary SQL commands via a crafted domain name that is accessed in a reverse DNS lookup. When "UseReverseDNS on" is enabled, the attacker-supplied hostname is passed unescaped into SQL queries. The character restrictions of DNS names may affect exploitability.
AnalysisAI
SQL injection in ProFTPD 1.3.9a and earlier allows remote attackers to execute arbitrary SQL commands when the 'UseReverseDNS on' configuration is enabled. The vulnerability exists in mod_wrap2_sql.c where attacker-controlled reverse DNS hostnames are passed unescaped into SQL queries during client access control checks. Exploitation complexity is high due to DNS character restrictions and specific configuration requirements. No active exploitation confirmed (not in CISA KEV), but upstream fix is available via GitHub commit 7666224. EPSS risk data not provided.
Technical ContextAI
ProFTPD's mod_wrap2_sql module implements TCP Wrappers-style access control using SQL databases. The sqltab_fetch_clients_cb() function performs reverse DNS lookups on connecting client IP addresses to resolve hostnames, then queries an SQL database to check access permissions. The CWE-89 SQL injection vulnerability occurs because the resolved hostname is concatenated directly into SQL queries without sanitization. The fix introduces sqltab_get_escaped_text() which calls mod_sql.c's sql_escapestr hook to properly escape user-controlled data before database operations. This affects installations using both mod_wrap2_sql for access control AND UseReverseDNS enabled, requiring mod_sql.c to be loaded. The attack surface is limited to reverse DNS responses, which are constrained by RFC-compliant DNS character sets (alphanumeric, hyphens, dots), though creative encoding may bypass these restrictions.
RemediationAI
Apply the upstream fix by upgrading to ProFTPD builds incorporating commit 766622456440fbca33abd7927c523673a11d1ed1 or later, which introduces proper SQL escaping via the sql_escapestr hook in mod_wrap2_sql.c (module version updated to 1.1). Source available at https://github.com/proftpd/proftpd/commit/766622456440fbca33abd7927c523673a11d1ed1. No tagged release version incorporating this fix is confirmed at time of analysis; administrators may need to build from source or await vendor-packaged updates. Immediate workaround: disable UseReverseDNS in proftpd.conf (set to 'off'), which eliminates the attack vector but sacrifices hostname-based access controls and may break configurations relying on DNS names in mod_wrap2_sql tables. Alternative mitigation: switch from mod_wrap2_sql to file-based mod_wrap2_file for access control, though this requires reconfiguring access policies and loses SQL-based centralized management. Ensure mod_sql.c is loaded if continuing to use mod_wrap2_sql, as the fix depends on the sql_escapestr symbol.
The mod_copy module in ProFTPD 1.3.5 allows remote attackers to read and write to arbitrary files via the site cpfr and
The SSH transport protocol with certain OpenSSH extensions, found in OpenSSH before 9.6 and other products, allows remot
An arbitrary file copy vulnerability in mod_copy in ProFTPD up to 1.3.5b allows for remote code execution and informatio
SQL injection escalating to remote code execution in ProFTPD's mod_sql before 1.3.10rc1 lets remote attackers inject SQL
make_ftp_cmd in main.c in ProFTPD before 1.3.8a has a one-byte out-of-bounds read, and daemon crash, because of mishandl
ProFTPD before 1.3.6b and 1.3.7rc before 1.3.7rc2 allows remote unauthenticated denial-of-service due to incorrect handl
Integer overflow in kbdint.c in mod_sftp in ProFTPD 1.3.4d and 1.3.5r3 allows remote attackers to cause a denial of serv
In ProFTPD 1.3.7, it is possible to corrupt the memory pool by interrupting the data transfer channel. Rated high severi
Arbitrary code execution in ProFTPD's mod_sftp module (versions before 1.3.9c and 1.3.10rc3) allows authenticated low-pr
Directory ACL bypass in ProFTPD (through 1.3.9b and 1.3.10rc2) lets authenticated FTP users reach files inside DenyAll-p
Authenticated remote denial of service in ProFTPD's mod_sftp module allows any user with valid SFTP credentials to crash
The mod_tls module in ProFTPD before 1.3.5b and 1.3.6 before 1.3.6rc2 does not properly handle the TLSDHParamFile direct
Same weakness CWE-89 – SQL Injection
View allVendor StatusVendor
SUSE
Severity: High| Product | Status |
|---|---|
| SUSE Linux Enterprise High Performance Computing 15 SP7 | Fixed |
| SUSE Linux Enterprise Module for Server Applications 15 SP7 | Fixed |
| SUSE Linux Enterprise Server 15 SP7 | Fixed |
| SUSE Linux Enterprise Server for SAP Applications 15 SP7 | Fixed |
| SUSE Linux Enterprise Module for Server Applications 15 SP6 | Fixed |
| SUSE Linux Enterprise Server 15 SP6 | Fixed |
| SUSE Linux Enterprise Server 15 SP6-LTSS | Fixed |
| SUSE Linux Enterprise Server for SAP Applications 15 SP6 | Fixed |
| SUSE Linux Enterprise High Performance Computing 15 SP6 | Fixed |
| openSUSE Leap 15.6 | Fixed |
Share
External POC / Exploit Code
Leaving vuln.today