Vulnerability in N/a
CVE-2009-0542
SQL injection vulnerability in ProFTPD Server 1.3.1 through 1.3.2rc2 allows remote attackers to execute arbitrary SQL commands via a "%" (percent) character in the username, which introduces a "'" (single quote) character during variable s…
EPSS: 0.585 (98.2th percentile) — read the EPSS interpretation.
Affected products
- N/a — versions n/a
Public proof-of-concept exploits
References
- DSA-1730 (vendor-advisory, x_refsource_DEBIAN)
- 20090210 Re: Another SQL injection in ProFTPd with mod_mysql (probably postgres as well) (mailing-list, x_refsource_BUGTRAQ)
- [oss-security] 20090211 Re: CVE request for proftpd (mailing-list, x_refsource_MLIST)
- bugs.proftpd.org/show_bug.cgi (x_refsource_CONFIRM)
- [oss-security] 20090211 Re: CVE request for proftpd (mailing-list, x_refsource_MLIST)
- 34268 (x_refsource_SECUNIA, third-party-advisory)
- MDVSA-2009:061 (vendor-advisory, x_refsource_MANDRIVA)
- 20090211 Re: Re: Another SQL injection in ProFTPd with mod_mysql (probably postgres as well) (mailing-list, x_refsource_BUGTRAQ)
- 20090210 ProFTPd with mod_mysql Authentication Bypass Exploit (mailing-list, x_refsource_BUGTRAQ)
- [oss-security] 20090211 CVE request for proftpd (mailing-list, x_refsource_MLIST)
Frequently asked questions
- What is CVE-2009-0542?
- CVE-2009-0542 is a vulnerability in N/a. Published 2009-02-12.
- Is CVE-2009-0542 known to be exploited?
- 4 public proof-of-concept repositories are indexed. Not currently listed in the CISA KEV catalog.