Skip to content
KitploitKITPLOIT
StrumentiBlog
Invia
StrumentiBlog
Invia

Strumenti di Hacking, PenTest e Cybersecurity per il tuo Arsenale di Sicurezza!

Kitploit è una directory di strumenti di hacking, cybersecurity e pentesting. Scopri gli ultimi aggiornamenti dei progetti per trovare vulnerabilità, analizzare sistemi, automatizzare i test e rafforzare la tua sicurezza.

··Feed·Contatto·Privacy·© 2026 Kitploit

Directory degli strumenti

Categorie

Vedi tutte le categorie
Loading categories
CVE-2026-42167 — Analisi tecnica e proof-of-concept per CVE-2026-42167, una SQL injection critica in ProFTPD mod_sql che consente il bypass dell'autenticazione, l'iniezione di utenti backdoor e l'esecuzione remota di codice. | Kitploit
Strumenti/GitHubGitHub/kaleth4/cve-2026-42167
Analisi delle VulnerabilitàExploitSfruttamento di Applicazioni WebPenetration TestingApprendimento e FormazioneRed Teaming
GitHubkaleth4/cve-2026-42167

CVE-2026-42167

Analisi tecnica e proof-of-concept per CVE-2026-42167, una SQL injection critica in ProFTPD mod_sql che consente il bypass dell'autenticazione, l'iniezione di utenti backdoor e l'esecuzione remota di codice.

Vedi Repository
3 mesi faNon ancora revisionato

Più Popolari

Vedi tutti →

Scopri gli strumenti più utilizzati dalla nostra community.

Esplora tutti gli strumenti

Sfoglia la nostra collezione di strumenti

Vedi tutti gli strumenti →
Condividi

CVE-2026-42167: SQL Injection in ProFTPD mod_sql

📋 Executive Summary

CVE-2026-42167 is a critical SQL injection vulnerability in the mod_sql module of ProFTPD that allows authentication bypass, backdoor user injection, and remote code execution (RCE).

AttributeValue
TypeSQL Injection (CWE-89)
SeverityHigh/Critical
CVSS v38.1
Componentmod_sql in ProFTPD < 1.3.9a
Reported byZeroPath Research
DateApril 28, 2026

🔍 Technical Description

The Problem: Weak Validation in is_escaped_text()

ProFTPD uses the is_escaped_text() function to determine whether a value has already been sanitized before inserting it into an SQL query. The function assumes that any input that:

  • Starts with a single quote '
  • Ends with a single quote '
  • Contains no internal single quotes

...has already been escaped and requires no further processing.

The Exploit

An attacker can send a malicious username such as:

root@kitploit:~
USER ' || (SELECT 1) ||'

When inserted into an SQL query such as:

root@kitploit:~
INSERT "'%U', '%r', '%m'" activity_log

The result is:

root@kitploit:~
INSERT "'' || (SELECT 1) || ''" activity_log

The payload executes as arbitrary SQL because the || operators concatenate empty strings around the injected command.

⚠️ Impact Scenarios

1️⃣ Remote Code Execution (RCE)

Requirements:

  • PostgreSQL backend
  • Database user with superuser privileges
  • SQL logging enabled with %U or %{basename} variables

Technique:

root@kitploit:~
COPY (SELECT 1) TO PROGRAM 'malicious_command'

Executes operating system-level commands as the postgres user.

2️⃣ Authentication Bypass

Requirements:

  • SQLAuthenticate enabled
  • SQL logging with %U variable in SQLLog ERR_* (pre-authentication)

Technique:

root@kitploit:~
INSERT INTO users (username, password, uid, homedir) 
VALUES ('attacker', 'password_hash', 0, '/')

The attacker injects a backdoor user with uid=0 (root) and access to the entire filesystem.

3️⃣ Data Exfiltration

Requirements:

  • Any SQL backend
  • SQL logging enabled

Technique: Time-based blind SQL injection to extract credentials character by character.

📊 Attack Vectors

Attacker-Controlled Variables

VariableMeaningScope
%UOriginal username (before authentication)Pre-auth
%AAnonymous login passwordPre-auth
%JCommand parametersPre-auth
%mFTP verb (STOR, RETR, etc.)Pre-auth
%{basename}Filename componentPost-auth
%lident response (RFC 1413)Pre-auth (if identd is available)

Exploitation Paths

Pre-authentication (most critical):

root@kitploit:~
%U + SQLLog ERR_* → No credentials required

Post-authentication:

root@kitploit:~
%{basename} + SQLLog STOR → Requires any valid FTP user

🛡️ Mitigation and Remediation

✅ Recommended Fix

Update immediately to ProFTPD 1.3.9a or later:

root@kitploit:~
# Check current version
proftpd -v

# Update (example for Debian/Ubuntu)
sudo apt-get update
sudo apt-get install proftpd-basic=1.3.9a-1

🔧 Temporary Mitigations

If you cannot update immediately:

  1. Disable SQL logging:
root@kitploit:~
# Comment out or remove these lines in proftpd.conf
# SQLLog * log_activity
# SQLLog ERR_* log_activity
  1. Apply the principle of least privilege:
root@kitploit:~
-- In PostgreSQL, create a user without superuser privileges
CREATE USER proftpd_user WITH PASSWORD 'secure_password';
GRANT SELECT, INSERT ON activity_log TO proftpd_user;
-- DO NOT grant SUPERUSER
  1. Monitor for exploit attempts:
root@kitploit:~
TraceLog /var/log/proftpd/trace.log
Trace sql:17

🔎 Vulnerability Verification

Indicator of Compromise

Look in ProFTPD trace logs (with Trace sql:17 enabled):

root@kitploit:~
text 'payload' is already escaped, skipping escaping it again

This message indicates that a bypass attempt has been processed by the vulnerable engine.

Command to Verify

root@kitploit:~
# Enable detailed traces
echo "Trace sql:17" >> /etc/proftpd/proftpd.conf

# Restart ProFTPD
sudo systemctl restart proftpd

# Monitor logs
tail -f /var/log/proftpd/trace.log | grep "already escaped"

📦 Version Information

VersionStatus
< 1.3.9❌ Vulnerable
1.3.9❌ Vulnerable
≥ 1.3.9a✅ Patched
≥ 1.3.10rc1✅ Patched

🧪 Proof of Concept (PoC)

Official Repository

GitHub: ZeroPathAI/proftpd-CVE-2026-42167-poc

Quick Setup with Docker

root@kitploit:~
# Clone repository
git clone https://github.com/ZeroPathAI/proftpd-CVE-2026-42167-poc.git
cd proftpd-CVE-2026-42167-poc

# Requirements
# - Docker
# - Git
# - Python 3.10+
# - uv (Python package manager)

# Set up vulnerable environment
cd setup
./setup.sh

# Run PoCs
cd ../pocs
python3 preauth_user_backdoor.py      # Inject backdoor user (pre-auth)
python3 preauth_user_rce.py           # RCE via COPY TO PROGRAM (pre-auth)
python3 postauth_stor_backdoor.py     # Inject user (post-auth)
python3 postauth_stor_rce.py          # RCE (post-auth)

# Clean up
cd ../setup
./teardown.sh

📅 Timeline

DateEvent
2026-03-28Vulnerability reported to ProFTPD
2026-04-07Verification and patch development
2026-04-24CVE-2026-42167 assigned
2026-04-27Patch released (commit af90843baf7dcb8c6be1e5261be2d0b5b5850673)
2026-04-27ProFTPD 1.3.9a released

📚 References

  • NVD: https://nvd.nist.gov/vuln/detail/CVE-2026-42167
  • Technical Blog: https://zeropath.com/blog/proftpd-cve-2026-42167-auth-bypass-privesc-rce
  • PoC Repository: https://github.com/ZeroPathAI/proftpd-CVE-2026-42167-poc
  • Release Notes: http://www.proftpd.org/docs/RELEASE_NOTES-1.3.10rc1
  • Discussion: https://github.com/proftpd/proftpd/issues/2052

⚡ Final Recommendations

  1. Immediate Action: Update ProFTPD to 1.3.9a or later
  2. Audit: Review SQLLog configurations on all ProFTPD servers
  3. Privileges: Ensure database users do not have superuser permissions
  4. Monitoring: Implement alerts for SQL injection attempts
  5. Patches: Maintain a regular patching program for all dependencies

Last updated: April 28, 2026
Source: ZeroPath Research, MITRE CVE, NVD

Scarica lo strumento