This article details CVE-2026-42167, a critical post-authentication SQL injection vulnerability in ProFTPD's mod_sql module that leads to Remote Code Execution (RCE). The flaw arises from a logical error in the is_escaped_text() helper function, which incorrectly treats STOR filenames beginning and ending with a single quote (and no interior quotes) as already escaped. This allows an attacker to inject and stack a second SQL statement after breaking out of the original INSERT query used for logging FTP activity.
Specifically, on PostgreSQL backends where the role is a superuser, this stacked statement can leverage COPY ... TO PROGRAM to execute arbitrary operating system commands. The exploit payload cleverly navigates FTP filename constraints, avoiding interior single quotes via dollar-quoting ($$...$$) and generating forward slashes (/) at runtime using printf's octal escape (\57). A crucial bug in widely circulated public Proof-of-Concept (PoC) code is also highlighted: printf's greedy consumption of octal digits could silently corrupt the attacker's reverse shell host/port if their first digit was 0-7, causing connection failures.
The provided Python script implements a fix for this PoC bug. Instead of directly interpolating the host/port into the printf format string, it passes them as separate arguments. This structural change ensures that no user-controlled digits are adjacent to octal escapes, preventing corruption and guaranteeing a reliable reverse shell connection. The vulnerability is classified as Critical due to its ability to achieve RCE after successful authentication.
Top comments (0)