Skip to content
KitploitKITPLOIT
ToolsBlog
Submit
ToolsBlog
Submit

Hacking, PenTest, and Cybersecurity Tools for Your Security Arsenal!

Kitploit is a directory of hacking, cybersecurity, and pentesting tools. Discover the latest project updates to find vulnerabilities, analyze systems, automate testing, and strengthen your security.

··Feeds·Contact·Privacy·© 2026 Kitploit

Tool Directory

Categories

View all categories
Loading categories
Tools/GitHubGitHub/jimmexploit/cve-2026-42167-poc
Vulnerability AnalysisExploitationWeb Application ExploitationPenetration TestingRed Teaming
GitHubjimmexploit/cve-2026-42167-poc

CVE-2026-42167-PoC

Functional SQL injection exploit for CVE-2026-42167 in ProFTPD mod_sql, enabling unauthenticated attackers to inject commands via USER parameter. Includes PoC and references.

View Repository
13 months agoNot yet reviewed

Most Popular

View all →

Discover the most used tools by our community.

Explore all tools

Browse our collection of tools

View all tools →
Share

CVE reported by ZeroPath Research original writeup: https://zeropath.com/blog/proftpd-cve-2026-42167-auth-bypass-privesc-rce

my version : https://jimmexploit.vercel.app/cve/proftpd-unauthenticated-sql-injection-leads-to-rce

Description

This repository contains a functional exploit for CVE-2026-42167. The flaw exists in how mod_sql handles certain logging variables (like %U), allowing an unauthenticated attacker to inject SQL commands via the USER command.

  • Vulnerability Type: SQL Injection (CWE-89)
  • Severity: High (CVSS 8.1)
  • Affected Versions: ProFTPD 1.3.9 and below.
  • Patched Version: ProFTPD 1.3.9a / 1.3.10rc1.

Disclimar

Unauthorized access to computer systems is illegal. I am not responsible for any misuse of this software. Use this PoC only on systems you own or have explicit permission to test.

Download Tool