CVE-2026-42167: SQL Injection in ProFTPD mod_sql

📋 Executive Summary

CVE-2026-42167 is a critical SQL injection vulnerability in ProFTPD's mod_sql module that allows authentication bypass, backdoor user injection, and remote code execution (RCE).

Attribute	Value
Type	SQL Injection (CWE-89)
Severity	High/Critical
CVSS v3	8.1
Component	mod_sql in ProFTPD < 1.3.9a
Reported by	ZeroPath Research
Date	April 28, 2026

---

🔍 Technical Description

The Problem: Weak Validation in is_escaped_text()

ProFTPD uses the is_escaped_text() function to determine whether a value has already been sanitized before inserting it into an SQL query. The function assumes that any input that:

• Starts with a single quote '
• Ends with a single quote '
• Contains no internal single quotes

...has already been escaped and requires no further processing.

The Exploit

An attacker can send a malicious username such as:

USER ' || (SELECT 1) ||'

When inserted into an SQL query such as:

INSERT "'%U', '%r', '%m'" activity_log

The result is:

INSERT "'' || (SELECT 1) || ''" activity_log

The payload executes as arbitrary SQL because the || operators concatenate empty strings around the injected command.

---

⚠️ Impact Scenarios

1️⃣ Remote Code Execution (RCE)

Requirements:

• PostgreSQL backend
• Database user with superuser privileges
• SQL logging enabled with %U or %{basename} variables

Technique:

COPY (SELECT 1) TO PROGRAM 'malicious_command'

Executes operating system-level commands as the postgres user.

2️⃣ Authentication Bypass

Requirements:

• SQLAuthenticate enabled
• SQL logging with %U variable in SQLLog ERR_* (pre-authentication)

Technique:

INSERT INTO users (username, password, uid, homedir) 
VALUES ('attacker', 'password_hash', 0, '/')

The attacker injects a backdoor user with uid=0 (root) and access to the entire filesystem.

3️⃣ Data Exfiltration

Requirements:

• Any SQL backend
• SQL logging enabled

Technique: Time-based blind SQL injection to extract credentials character by character.

---

📊 Attack Vectors

Attacker-Controlled Variables

Variable	Meaning	Scope
%U	Original username (before authentication)	Pre-auth
%A	Anonymous login password	Pre-auth
%J	Command parameters	Pre-auth
%m	FTP verb (STOR, RETR, etc.)	Pre-auth
%{basename}	Filename component	Post-auth
%l	ident response (RFC 1413)	Pre-auth (if identd is available)

Exploitation Paths

Pre-authentication (most critical):

%U + SQLLog ERR_* → No credentials required

Post-authentication:

%{basename} + SQLLog STOR → Requires any valid FTP user

---

🛡️ Mitigation and Remediation

✅ Recommended Fix

Update immediately to ProFTPD 1.3.9a or later:

# Check current version
proftpd -v

# Update (example for Debian/Ubuntu)
sudo apt-get update
sudo apt-get install proftpd-basic=1.3.9a-1

🔧 Temporary Mitigations

If you cannot update immediately:

1. Disable SQL logging:

# Comment out or remove these lines in proftpd.conf
# SQLLog * log_activity
# SQLLog ERR_* log_activity

2. Apply the principle of least privilege:

-- In PostgreSQL, create a user without superuser privileges
CREATE USER proftpd_user WITH PASSWORD 'secure_password';
GRANT SELECT, INSERT ON activity_log TO proftpd_user;
-- DO NOT grant SUPERUSER

3. Monitor for exploit attempts:

TraceLog /var/log/proftpd/trace.log
Trace sql:17

---

🔎 Vulnerability Verification

Indicator of Compromise

Search ProFTPD trace logs (with Trace sql:17 enabled):

text 'payload' is already escaped, skipping escaping it again

This message indicates that a bypass attempt has been processed by the vulnerable engine.

Verification Command

# Enable detailed traces
echo "Trace sql:17" >> /etc/proftpd/proftpd.conf

# Restart ProFTPD
sudo systemctl restart proftpd

# Monitor logs
tail -f /var/log/proftpd/trace.log | grep "already escaped"

---

📦 Version Information

Version	Status
< 1.3.9	❌ Vulnerable
1.3.9	❌ Vulnerable
≥ 1.3.9a	✅ Patched
≥ 1.3.10rc1	✅ Patched

---

🧪 Proof of Concept (PoC)

Official Repository

GitHub: ZeroPathAI/proftpd-CVE-2026-42167-poc

Quick Setup with Docker

# Clone repository
git clone https://github.com/ZeroPathAI/proftpd-CVE-2026-42167-poc.git
cd proftpd-CVE-2026-42167-poc

# Requirements
# - Docker
# - Git
# - Python 3.10+
# - uv (Python package manager)

# Set up vulnerable environment
cd setup
./setup.sh

# Run PoCs
cd ../pocs
python3 preauth_user_backdoor.py      # Inject backdoor user (pre-auth)
python3 preauth_user_rce.py           # RCE via COPY TO PROGRAM (pre-auth)
python3 postauth_stor_backdoor.py     # Inject user (post-auth)
python3 postauth_stor_rce.py          # RCE (post-auth)

# Clean up
cd ../setup
./teardown.sh

---

📅 Timeline

Date	Event
2026-03-28	Vulnerability reported to ProFTPD
2026-04-07	Verification and patch development
2026-04-24	CVE-2026-42167 assigned
2026-04-27	Patch released (commit af90843baf7dcb8c6be1e5261be2d0b5b5850673)
2026-04-27	ProFTPD 1.3.9a released

---

📚 References

• NVD: https://nvd.nist.gov/vuln/detail/CVE-2026-42167
• Technical Blog: https://zeropath.com/blog/proftpd-cve-2026-42167-auth-bypass-privesc-rce
• PoC Repository: https://github.com/ZeroPathAI/proftpd-CVE-2026-42167-poc
• Release Notes: http://www.proftpd.org/docs/RELEASE_NOTES-1.3.10rc1
• Discussion: https://github.com/proftpd/proftpd/issues/2052

---

⚡ Final Recommendations

1. Immediate Action: Update ProFTPD to 1.3.9a or later
2. Audit: Review SQLLog configurations on all ProFTPD servers
3. Privileges: Ensure database users do not have superuser permissions
4. Monitoring: Implement alerts for SQL injection attempts
5. Patches: Maintain a regular patching program for all dependencies

---

Last updated: April 28, 2026
Source: ZeroPath Research, MITRE CVE, NVD