CVE-2009-0542
Fixed in a distro release EPSS 74%
SQL injection vulnerability in ProFTPD Server 1.3.1 through 1.3.2rc2 allows remote attackers to execute arbitrary SQL commands via a "%" (percent) character in the username, which introduces a "'" (single quote) character during variable substitution by mod_sql.
Products: proftpd_project proftpd
Distro releases
| Release | Package | Fixed in |
|---|---|---|
| Debian 12 | proftpd-dfsg | 1.3.2-1 |
| Debian 13 | proftpd-dfsg | 1.3.2-1 |
| Debian 14 | proftpd-dfsg | 1.3.2-1 |
| Debian 5.0 | proftpd-dfsg | 1.3.1-17lenny1 |
| Debian 5.0 | proftpd-dfsg | 1.3.1-17lenny2 |
| openSUSE Tumbleweed | proftpd | 1.3.5b-2.5 |