ProFTPD CVE-2026-44331

Requires ProFTPD configuration with 'UseReverseDNS on' directive (non-default in many setups) AND active use of mod_wrap2_sql contrib module for SQL-based access control. Attacker must control reverse DNS (PTR) records for their source IP address, requiring either ownership of IP space or compromise of authoritative DNS servers. SQL injection payload construction is constrained by DNS RFC character restrictions: hostnames limited to alphanumeric characters, hyphens, and dots, with length limits (63 chars per label, 253 total). These DNS constraints significantly limit exploitability compared to typical SQL injection-advanced payloads using quotes, semicolons, or UNION operators may require creative encoding within DNS rules. mod_sql.c must be available (though the vulnerable code doesn't verify this before the fix).

CVSS 8.1 (High) indicates network-accessible, unauthenticated exploitation with high impact on confidentiality, integrity, and availability, but AC:H (high complexity) significantly reduces real-world risk. Exploitation requires three concurrent conditions: (1) ProFTPD configured with UseReverseDNS on (non-default in many deployments), (2) mod_wrap2_sql module active for access control, and (3) attacker control over reverse DNS records for their source IP. DNS character restrictions (limited to [a-z0-9.-]) constrain SQL injection payloads - many advanced techniques require quotes, semicolons, or special characters disallowed in DNS. No CISA KEV listing indicates no confirmed active exploitation. No public POC identified in references. The GitHub commit provides a clear remediation path. Risk assessment: Medium-priority for organizations using mod_wrap2_sql with reverse DNS enabled; low-priority for default ProFTPD installations without these specific modules. The attack complexity and narrow configuration requirements make this a targeted threat rather than broad internet-scanning risk, despite the high CVSS score.

An attacker controlling reverse DNS records for their IP address configures a malicious PTR record containing SQL injection payloads constrained to DNS-allowed characters (alphanumeric, hyphens, dots). When connecting to a ProFTPD server with UseReverseDNS enabled and mod_wrap2_sql active, the server performs a reverse lookup, retrieves the attacker's crafted hostname, and passes it unescaped into SQL queries checking access permissions. Successful injection could manipulate access control logic (bypassing IP restrictions), extract database contents (credentials, user lists), or modify access rules. Public POC not identified, but the commit diff clearly shows the injection point in sqltab_fetch_clients_cb().