CVE-2009-0542
NoneCVSS
—
EPSS
73.8%
Published
Feb 12, 2009
CISA due date
—
The record
SQL injection vulnerability in ProFTPD Server 1.3.1 through 1.3.2rc2 allows remote attackers to execute arbitrary SQL commands via a "%" (percent) character in the username, which introduces a "'" (single quote) character during variable substitution by mod_sql.
Affected packages
| Ecosystem | Package | Introduced | Fixed |
|---|---|---|---|
| Debian:10 | proftpd-dfsg | 0 | 1.3.2-1 |
| Debian:11 | proftpd-dfsg | 0 | 1.3.2-1 |
| Debian:12 | proftpd-dfsg | 0 | 1.3.2-1 |
| Debian:13 | proftpd-dfsg | 0 | 1.3.2-1 |
| Debian:5.0 | proftpd-dfsg | 0 | 1.3.1-17lenny1 |
| Debian:5.0 | proftpd-dfsg | 0 | 1.3.1-17lenny2 |
| openSUSE:Tumbleweed | proftpd | 0 | 1.3.5b-2.5 |
Related vulnerabilities
- CVE-2011-4130 Use-after-free vulnerability in the Response API in ProFTPD before 1.3.3g allows remote… Also affects proftpd-dfsg
- CVE-2009-0543 ProFTPD Server 1.3.1, with NLS support enabled, allows remote attackers to bypass SQL… Also affects proftpd-dfsg
- CVE-2007-2165 The Auth API in ProFTPD before 20070417, when multiple simultaneous authentication… Also affects proftpd-dfsg
- CVE-2006-6170 Buffer overflow in the tls_x509_name_oneline function in the mod_tls module, as used in… Also affects proftpd-dfsg
- CVE-2006-5815 Stack-based buffer overflow in the sreplace function in ProFTPD 1.3.0 and earlier allows… Also affects proftpd-dfsg
- CVE-2005-4816 Buffer overflow in mod_radius in ProFTPD before 1.3.0rc2 allows remote attackers to cause… Also affects proftpd-dfsg
- CVE-2024-48651 In ProFTPD through 1.3.8b before cec01cc, supplemental group inheritance grants… Also affects proftpd-dfsg
- CVE-2015-3306 The mod_copy module in ProFTPD 1.3.5 allows remote attackers to read and write to… Also affects proftpd-dfsg