CVE-2009-0542

2009-02-1216:30:00

CWE-89

[email protected]

web.nvd.nist.gov

cve-2009-0542

proftpd server

sql injection

vulnerability

remote attackers

arbitrary sql commands

mod_sql

7.5 High

CVSS2

Attack Vector

NETWORK

Attack Complexity

LOW

Authentication

NONE

Confidentiality Impact

PARTIAL

Integrity Impact

PARTIAL

Availability Impact

PARTIAL

AV:N/AC:L/Au:N/C:P/I:P/A:P

8.1 High

AI Score

Confidence

Low

0.927 High

EPSS

Percentile

99.0%

JSON

SQL injection vulnerability in ProFTPD Server 1.3.1 through 1.3.2rc2 allows remote attackers to execute arbitrary SQL commands via a “%” (percent) character in the username, which introduces a “'” (single quote) character during variable substitution by mod_sql.

Affected configurations

NVD

Node

proftpd_projectproftpdMatch1.3.1

proftpd_projectproftpdMatch1.3.2

proftpd_projectproftpdMatch1.3.2_rc2

CPENameOperatorVersion
proftpd_project:proftpdproftpd project proftpdeq1.3.1
proftpd_project:proftpdproftpd project proftpdeq1.3.2
proftpd_project:proftpdproftpd project proftpdeq1.3.2_rc2

CPE	Name	Operator	Version
proftpd_project:proftpd	proftpd project proftpd	eq	1.3.1
proftpd_project:proftpd	proftpd project proftpd	eq	1.3.2
proftpd_project:proftpd	proftpd project proftpd	eq	1.3.2_rc2