mod_sql in ProFTPD before 1.3.10rc1 allows remote attackers to execute arbitrary code via a username, in scenarios where there is logging of USER requests with an expansion such as %U, and the SQL backend allows commands (e.g., COPY TO PROGRAM).
| Vendor | Product | Versions |
|---|---|---|
| proftpd | proftpd | 1.3.7b |
Downstream vendors/products affected by this vulnerability
| Vendor | Product | Source | Confidence |
|---|---|---|---|
| open source | proftpd | cert_advisory | 90% |
Updated affected versions to include 1.3.9, changed severity to CRITICAL, and noted that there is no exploit available.
Initial creation
