Critical SQL Injection Flaw in ProFTPD Exposes Servers to Remote Attacks A severe SQL injection vulnerability (CVE-2026-42167) has been discovered in ProFTPD, a widely used FTP server deployed across Linux distributions and web hosting platforms. With a CVSS score of 8.1, the flaw affects the mod_sql extension, which enables database-backed authentication and logging. The vulnerability stems from a logical error in the is_escaped_text() function, which processes logging variables like `%U` (username). Attackers can exploit this by crafting a username that begins and ends with a single quote tricking the system into bypassing sanitization and executing unauthorized SQL commands. Potential Impacts: - Authentication Bypass: If pre-authentication logging is enabled, attackers can inject a backdoor user with full system privileges. - Remote Code Execution (RCE): When ProFTPD connects to a PostgreSQL database with superuser privileges, attackers can abuse the COPY TO PROGRAM feature to execute arbitrary code on the host. - Data Theft: Blind SQL injection techniques may allow exfiltration of sensitive data, including plaintext passwords or hashes. The flaw’s severity varies based on server configuration, but its widespread use in hosting environments amplifies the risk. ProFTPD version 1.3.9a patches the issue, while temporary mitigations include disabling mod_sql logging. Security teams are advised to monitor FTP and database activity for signs of exploitation, such as unauthorized user creation or unusual queries.