HighPublic exploitVulnerability

CVE-2026-42167

SQL injection in ProFTPD mod_sql logging

Published Apr 28, 2026 · Updated 13 days ago

Trending this weekNot trendingOutside this week’s top 100

Mention activity · 30 days

1 mention · peak 1 in a dayToday

CVSS8.1High · v3.1

EPSS7.4%94th percentile

CISA KEVNoNot listed

In the wildNonePublic exploit, no exploitation reported

Vendor: Proftpd

IdentifiersCVE-2026-42167CWE-89 · Improper Neutralization of Special…

CVE-2026-42167 is a SQL injection vulnerability in ProFTPD's mod_sql logging pipeline. The is_escaped_text() function incorrectly considers values already escaped when they begin and end with a single quote and contain no internal single quotes. Consequently, sql_resolved_append_text() can omit backend escaping for attacker-controlled FTP values interpolated into SQLNamedQuery statements invoked by SQLLog. Vulnerable logging configurations allow crafted usernames to trigger injection before authentication; other configurations expose post-authentication command inputs. The vulnerable logic was introduced in ProFTPD 1.3.8a and backported to 1.3.7b. Fixes are available in 1.3.9a and 1.3.10rc1. Exploitation can enable database disclosure and modification, authentication bypass, privilege escalation, and configuration-dependent remote code execution.

Do you run this?See affected versions in your environment and whether adversaries are exploiting this vulnerability against assets like yours.

Check your exposure

Analyst brief

Impact, mitigation & remediation

What it means and what to do now: patch path, interim mitigations, and the assume-compromise checklist.

Impact

What an attacker gets, and what they’ve been doing with it.

Successful exploitation permits unauthorized SQL execution with the privileges of ProFTPD's database connection. Attackers can extract authentication data, including plaintext passwords or password hashes, and insert attacker-controlled FTP accounts with chosen credentials and access attributes. Such accounts can bypass authentication restrictions and potentially obtain broad filesystem access through ProFTPD. PostgreSQL supports stacked-query exploitation and remote command execution through COPY TO PROGRAM when the database role has the required privileges; demonstrated execution occurs on the database host as the PostgreSQL operating-system user. SQLite supports stacked queries and backdoor-account insertion. MySQL exploitation is more constrained because the mod_sql integration does not enable multi-statement execution, although single-statement and blind extraction techniques remain possible.

Mitigation

If you can’t patch tonight, do this now.

If upgrading is not immediately possible, disable logging through mod_sql. Monitor FTP and database activity for unexpected account creation and unusual SQL queries. Removing PostgreSQL superuser privileges from the ProFTPD database role limits the documented command-execution path but does not eliminate SQL injection, credential disclosure, or authentication-table manipulation.

Remediation

Patch, then assume compromise.

Upgrade to ProFTPD 1.3.9a or a later fixed stable release. ProFTPD 1.3.10rc1 also contains the fix. The patch ensures that client-supplied log variables undergo backend SQL escaping before query construction and adds an already_escaped parameter to sql_resolved_append_text() so correctly escaped values do not depend on the flawed heuristic.

Public exploits

Exploits

6 exploits validated by Mallory's analysis. Hidden: 1 not yet analyzed, such as Exploit-DB entries.

View more in app →

proftpd-CVE-2026-42167-pocRepository contains a self-contained proof-of-concept lab and four Python exploit scripts for CVE-2026-42167 in ProFTPD mod_sql. The vulnerability is an SQL escaping bypass in mod_sql logging where attacker-controlled values that begin and end with a single quote and contain no internal single quotes are treated as already escaped. When administrators use documented SQLNamedQuery patterns that wrap variables such as %U or %{basename} in single quotes, the attacker can break out of the intended string context and inject raw SQL. Structure: README.md documents the bug, exploitation conditions, and impact. The pocs/ directory contains four standalone Python scripts: preauth_user_backdoor.py and preauth_user_rce.py exploit the pre-auth USER/%U path; postauth_stor_backdoor.py and postauth_stor_rce.py exploit the authenticated STOR/%{basename} path. The setup/ directory builds a Docker lab with ProFTPD and PostgreSQL, seeds a vulnerable schema, and exposes FTP on localhost:2121 and PostgreSQL on localhost:15432. Main capabilities: (1) unauthenticated SQL injection via FTP USER when SQLLog ERR_* logs %U; (2) authenticated SQL injection via crafted STOR filename when SQLLog logs %{basename}; (3) insertion of a backdoor FTP account into the SQL auth table with uid/gid 0 and homedir /; and (4) PostgreSQL-host RCE via stacked queries using COPY TO PROGRAM, delivering a bash reverse shell and upgrading it to an interactive PTY using util-linux script. The exploit code is real and operational, not merely detection logic. It performs banner checks, verifies whether the backdoor account already exists, sends crafted FTP commands or uploads, and validates success by logging in as the injected user or waiting for a reverse-shell callback. The lab configuration in setup/proftpd.conf intentionally enables the vulnerable SQLLog patterns, and seed.sql creates users, groups, activity_log, xfer_log, and secrets tables to demonstrate impact.ZeroPathAI · Disclosed Apr 28, 2026 · python · bash · network · webOperational proftpd-CVE-2026-42167-analysisRepository is a full standalone exploit lab and PoC suite for CVE-2026-42167 in ProFTPD mod_sql. The core issue is an escaping bypass in contrib/mod_sql.c where is_escaped_text() treats attacker-controlled values that begin and end with a single quote and contain no internal quotes as already escaped, causing sql_escapestring() to be skipped. The repository demonstrates that when admins follow documented SQLNamedQuery patterns that wrap variables like %U or %{basename} in single quotes, attacker input can break out of the intended SQL context and execute arbitrary SQL. Structure: top-level README.md provides root-cause analysis, exposure discussion, and reproduction notes; logs/ contains captured proof outputs for successful exploitation; poc/pocs/ contains four Python exploit scripts plus one non-interactive RCE marker script; poc/setup/ contains Docker-based lab automation (Dockerfile, docker-compose, ProFTPD config, seed SQL, setup/teardown scripts); render_screenshot.py is an auxiliary utility for rendering logs to PNG. Main exploit capabilities: (1) pre-auth SQL injection via FTP USER combined with SQLLog ERR_* and %U, allowing unauthenticated arbitrary SQL execution; (2) post-auth SQL injection via crafted STOR filename combined with %{basename}, allowing any authenticated FTP user to execute arbitrary SQL; (3) insertion of a privileged SQL-authenticated FTP backdoor account into the users table, demonstrated as backdoor/pwned123 with uid=0 and homedir=/; (4) PostgreSQL-host OS command execution via stacked SQL and COPY TO PROGRAM; (5) interactive reverse shell with PTY upgrade in the RCE scripts; (6) non-interactive marker-file proof of RCE in preauth_rce_marker.py. The Python PoCs are self-contained and use standard library networking/FTP modules. preauth_user_backdoor.py and postauth_stor_backdoor.py verify target reachability, confirm the backdoor account does not already exist, send the SQLi payload, then authenticate as the injected user to prove compromise. preauth_user_rce.py and postauth_stor_rce.py build COPY TO PROGRAM payloads that launch a bash reverse shell back to a local listener and then upgrade the shell using util-linux script. preauth_rce_marker.py is a safer validation variant that writes /tmp/cve-2026-42167-rce.txt on the PostgreSQL host instead of opening an interactive shell. The setup environment intentionally builds a vulnerable ProFTPD commit (ae25959adb05ae1d6ebfa1f36bf778c9c34e9410) with mod_sql_postgres, seeds a PostgreSQL 15 database, and configures vulnerable SQLLog directives in proftpd.conf. Exposed lab services are FTP on 2121, passive FTP ports 60000-60010, and PostgreSQL on 15432. Overall, this is a real exploit repository, not just documentation: it contains working exploit code, environment provisioning, and captured evidence of successful auth bypass, privilege escalation, and DB-host RCE.dinosn · Disclosed Apr 29, 2026 · python · bash · network · webOperational CVE-2026-42167-PoCRepository contains a single Python proof-of-concept exploit and a detailed README. The Python script is the operational entry point: it connects to a target FTP service, validates the banner, constructs a SQL injection payload that satisfies the documented is_escaped_text() bypass constraints, starts a local TCP listener, and sends the payload in the FTP USER command from a background thread. The injected SQL uses stacked PostgreSQL queries and COPY TO PROGRAM to execute a bash command on the PostgreSQL host. In its active form, the exploit reads an arbitrary file from the target-side host and exfiltrates it to the attacker over a raw TCP callback; the script also defines but does not use a reverse-shell bash command variant. The exploit is pre-authentication and network-based, targeting ProFTPD mod_sql/mod_sql_postgres deployments where SQL logging includes %U before authentication and the PostgreSQL role is overly privileged. The README provides vulnerability background, affected versions, root-cause explanation, prerequisites, and references, but the actual exploit logic resides entirely in CVE-2026-42167-preauth-user-rce.py.Sl4cK0TH · Disclosed May 1, 2026 · python · markdown · network · webOperational CVE-2026-42167-ExploitRepository is a small standalone Python exploit project for alleged CVE-2026-42167 affecting ProFTPD mod_sql. It contains 4 files: a Python exploit script, README, MIT license, and a text wordlist. The main entry point is proftpd_master_exploit.py. The exploit script connects directly to a target FTP service over TCP using Python's socket library, receives the FTP banner, and sends a crafted USER command containing a SQL injection payload. The payload is designed to break out of expected quoting and execute PostgreSQL-specific logic using pg_sleep() for timing-based inference. Core capability is blind unauthenticated SQL injection over the FTP protocol, not code execution. The script then uses pg_read_file() to test whether remote files are readable, LENGTH() to infer file size, and ASCII(SUBSTRING(...)) to recover file contents one character at a time. Operational flow: 1. Parse CLI arguments for target host, port, sleep interval, optional wordlist, and optional specific file. 2. Verify injection by testing a true condition and measuring response delay. 3. If a specific file is provided, attempt direct exfiltration. 4. If a wordlist is provided, iterate candidate names and append common extensions to discover readable files. 5. For each discovered file, determine length and exfiltrate contents character-by-character. Notable implementation details: - Uses default FTP port 2121 unless overridden. - Uses SQL comment syntax /**/ as a no-space bypass. - Uses a fixed candidate character set for extraction, so unsupported characters become '?'. - Contains a bug: test_breakout() calls _check_condition with an extra argument, which would raise a TypeError at runtime in the current code as written. Aside from that defect, the repository clearly intends to be an exploit rather than a detector. Repository structure and purpose: - proftpd_master_exploit.py: main exploit logic and CLI. - README.md: vulnerability description, usage examples, and feature list. - common.txt: local wordlist used for candidate file discovery. - LICENSE: MIT license. Overall, this is an operational proof-of-concept style exploit for unauthenticated file disclosure via blind SQL injection against a PostgreSQL-backed ProFTPD mod_sql deployment, with built-in scanning and exfiltration workflow.efeanilarslan · Disclosed May 2, 2026 · python · markdown · network · webOperational CVE-2026-42167-PoCSmall standalone Go exploit repository with 4 files: README.md, go.mod, empty go.sum, and a single executable source file main.go. The code is not part of a known exploit framework. main.go is the sole entry point and implements a TCP FTP client helper (ftpCmd) plus two exploit modes: backdoorMode and rceMode. Core capability: the exploit targets an alleged pre-authentication SQL injection in ProFTPD mod_sql logging tied to USER input, identified in the README as CVE-2026-42167. It connects directly to an FTP server, reads the banner, and sends crafted USER/PASS sequences. In backdoor mode, it injects an SQL INSERT INTO users statement intended to create a new account with uid/gid 0, home directory /, and shell /bin/bash, then attempts to authenticate with the injected credentials to confirm success. In rce mode, it injects a SQL COPY ... TO PROGRAM statement to execute a bash reverse shell that connects back to an operator-supplied listener. Repository structure and purpose: this is a focused proof-of-concept/operational exploit rather than a library or framework module. There is no scanning, brute force, persistence beyond the inserted account, or post-exploitation automation. The helper function ftpCmd handles raw FTP command exchange over TCP with timeouts and simplistic multiline response parsing. Command-line flags allow operator control over target host/port, exploit mode, injected username/password, and reverse shell callback host/port. Notable endpoints and observables: target FTP service is operator-supplied, defaulting to TCP port 2121; reverse shell callback is operator-supplied, defaulting to port 9998; FTP commands USER, PASS, PWD, and QUIT are used; filesystem artifacts embedded in payloads include / and /bin/bash; the reverse shell uses bash /dev/tcp/<host>/<port>. Overall, this is a real exploit implementation with active exploitation logic and payload delivery, not merely a detector.jimmexploit · Disclosed May 2, 2026 · go · markdown · network · webOperational CVE-2026-42167This repository is a small standalone Go exploit project centered on main.go, with supporting Markdown documentation (README.md, Build.md, Use.md). The code implements a CLI tool for exploiting the claimed ProFTPD mod_sql SQL injection vulnerability CVE-2026-42167 over the FTP protocol. It is not a framework module. Core exploit flow: the tool opens a raw TCP connection to an FTP service, reads the banner, and sends FTP USER/PASS commands. The USER field carries a crafted SQL injection string intended to abuse vulnerable SQL logging behavior. In backdoor mode, the payload injects an INSERT INTO users statement to create a new account with uid=0, home directory /, and shell /bin/bash, then reconnects and attempts to authenticate with the injected credentials to verify success. In RCE mode, the payload uses PostgreSQL COPY TO PROGRAM to execute a bash reverse shell that connects back to an operator-supplied lhost/lport. Repository structure is simple: main.go contains all exploit logic, argument parsing, network handling, payload construction, and colored console output. README.md and Use.md describe the vulnerability, prerequisites, and usage examples. Build.md gives compilation guidance. The go.mod content appears malformed and the import for the color library is redacted/broken ("://github.com"), so the repository as provided would require cleanup before compiling, but the exploit intent and logic are clear. Main capabilities: - Connect to a target FTP server over TCP - Deliver SQLi via FTP USER command - Trigger vulnerable SQL logging path with PASS - Create a persistent privileged backdoor account - Verify backdoor login success - Execute OS commands through PostgreSQL COPY TO PROGRAM - Launch a bash reverse shell to an attacker-controlled listener Overall, this is an operational proof-of-concept exploit for network-based pre-authentication abuse of a vulnerable ProFTPD deployment, with two offensive modes: account injection and reverse-shell RCE.kaleth4 · Disclosed May 4, 2026 · go · markdown · network · webOperational

Exposure surface

Affected products & vendors

Products and vendors Mallory has correlated with this vulnerability. Open in Mallory to drill down to specific CPE configurations and version ranges.

VendorProductType

ProftpdProftpdapplication

External references

References

MITRE CVEcve.org · CVE-2026-42167 NVDnvd.nist.gov/vuln/detail/CVE-2026-42167 MITRE CWE · CWE-89Improper Neutralization of Special Elements…Patchgithub.com/proftpd/proftpd/issues/2052 Third Party Advisorygithub.com/ZeroPathAI/proftpd-CVE-2026-42167-poc Third Party Advisoryzeropath.com/blog/proftpd-cve-2026-42167-auth-bypass-privesc-rce Release Notesproftpd.org/docs/RELEASE_NOTES-1.3.10rc1 Mailing Listopenwall.com/lists/oss-security/2026/05/01/13 Mailing Listopenwall.com/lists/oss-security/2026/05/01/4 Mailing Listopenwall.com/lists/oss-security/2026/05/01/4

Activity feed

Recent activity

40 sources tracked across advisories, community write-ups, and news. New activity surfaces here as Mallory finds it.

View more in app →

cyber security newsNews · Apr 30, 2026ProFTPD’s SQL injection Vulnerability Enables Remote Code Execution AttacksA critical SQL injection vulnerability in ProFTPD's mod_sql extension caused by a logical flaw in the is_escaped_text() function. Under certain configurations, it can enable authentication bypass, privilege escalation, data theft, and potentially remote code execution.Read more ↗nuclei templates pull requestsNews · Apr 29, 2026Create CVE-2026-42167.yaml by pussycat0x · Pull Request #16066 · projectdiscovery/nuclei-templates · GitHubUnknownRead more ↗cvefeed high severityNews · Apr 28, 2026CVE-2026-42167 - ProFTPD mod_sql Remote Code Execution VulnerabilityA remote code execution vulnerability in ProFTPD's mod_sql component affecting versions before 1.3.10rc1. It can be triggered via a crafted username when USER requests are logged with expansions such as %U and the SQL backend permits command execution.Read more ↗bugflationNews · Apr 28, 2026ZeroPath finds ProFTPD mod_sql CVE-2026-42167 - BugflationA SQL injection vulnerability in ProFTPD’s mod_sql logging pipeline that can be triggered via attacker-controlled FTP session values in SQL log-format expansions. Depending on configuration, it may enable pre-authentication or post-authentication abuse including auth bypass, backdoor-user insertion, credential exfiltration, and PostgreSQL-backed remote code execution.Read more ↗

+1 more in the timeline. Sign up to see them

Do you run this?See affected versions in your environment and whether adversaries are exploiting this vulnerability against assets like yours.

Check your exposure

Mallory platform

The version that knows your environment.

This page is what’s public. Mallory adds the parts that aren’t: which of your assets are affected, which adversaries are exploiting it right now, and which detections to deploy tonight.

Start Free Trial Open in App ↗

Exposure mappingQuery your assets running an affected version, and investigate the blast radius.

Threat actor evidenceEvery report linking this CVE to a named adversary.

Associated malwareMalware families linked to this CVE, with evidence and IOCs.

Detection signaturesYARA, Sigma, Snort, and vendor rules, auto-deployed to your SIEM.

Vendor-by-vendor mappingCross-references every affected SKU, including bundled OEM variants.

Social activity35Community discussion across Reddit, Mastodon, and other social sources.