ProFTPD mod_sql用户名SQL注入漏洞

BUGTRAQ ID: 33722 ProFTPD是一款开放源代码FTP服务程序。 ProFTPD的SQL认证模块没有正确地处理百分号字符（%）。在modsql查询中，可使用百分号表示变量。当modsql模块查找到百分号时，就会试图用变量替换，这就改变了基本查询的用户名。例如，对于用户名tj%string.com，由于会使用FTP响应状态替换百分号，但不存在状态值，因此会使用默认的“-”字符串，这个用户名最终变为tj-tring.com。 ProFTPD Project ProFTPD 1.3.2 ProFTPD Project ProFTPD 1.3.1 厂商补丁： ProFTPD...

ProFTPD Username Variable Substitution SQL Injection

Binary data 4930.prm...

DSquare Exploit Pack: D2SEC_PROFTPD_MODSQL

Name| d2secproftpdmodsql ---|--- CVE| CVE-2009-0542 Exploit Pack| D2ExploitPack Description| d2secproftpdmodsql Notes|...

CVE-2009-0542

SQL injection vulnerability in ProFTPD Server 1.3.1 through 1.3.2rc2 allows remote attackers to execute arbitrary SQL commands via a "%" percent character in the username, which introduces a "'" single quote character during variable substitution by modsql...

Sql injection

SQL injection vulnerability in ProFTPD Server 1.3.1 through 1.3.2rc2 allows remote attackers to execute arbitrary SQL commands via a "%" percent character in the username, which introduces a "'" single quote character during variable substitution by modsql...

Sql injection

ProFTPD Server 1.3.1, with NLS support enabled, allows remote attackers to bypass SQL injection protection mechanisms via invalid, encoded multibyte characters, which are not properly handled in 1 modsqlmysql and 2 modsqlpostgres...

DEBIAN-CVE-2009-0542

SQL injection vulnerability in ProFTPD Server 1.3.1 through 1.3.2rc2 allows remote attackers to execute arbitrary SQL commands via a "%" percent character in the username, which introduces a "'" single quote character during variable substitution by modsql...

CVE-2009-0542

SQL injection vulnerability in ProFTPD Server 1.3.1 through 1.3.2rc2 allows remote attackers to execute arbitrary SQL commands via a "%" percent character in the username, which introduces a "'" single quote character during variable substitution by modsql...

CVE-2009-0543

ProFTPD Server 1.3.1, with NLS support enabled, allows remote attackers to bypass SQL injection protection mechanisms via invalid, encoded multibyte characters, which are not properly handled in 1 modsqlmysql and 2 modsqlpostgres...

CVE-2009-0543

ProFTPD Server 1.3.1, with NLS support enabled, allows remote attackers to bypass SQL injection protection mechanisms via invalid, encoded multibyte characters, which are not properly handled in 1 modsqlmysql and 2 modsqlpostgres...

CVE-2009-0542

SQL injection vulnerability in ProFTPD Server 1.3.1 through 1.3.2rc2 allows remote attackers to execute arbitrary SQL commands via a "%" percent character in the username, which introduces a "'" single quote character during variable substitution by modsql...

CVE-2009-0543

ProFTPD Server 1.3.1, with NLS support enabled, allows remote attackers to bypass SQL injection protection mechanisms via invalid, encoded multibyte characters, which are not properly handled in 1 modsqlmysql and 2 modsqlpostgres...

DEBIAN-CVE-2009-0543

ProFTPD Server 1.3.1, with NLS support enabled, allows remote attackers to bypass SQL injection protection mechanisms via invalid, encoded multibyte characters, which are not properly handled in 1 modsqlmysql and 2 modsqlpostgres...

CVE-2009-0542

ProFTPD is affected by CVE-2009-0542 and related CVEs. Affects ProFTPD Server 1.3.1–1.3.2rc2 where a percent character in the username can introduce a single quote during mod_sql variable substitution, enabling remote SQL execution. Connected documents also indicate older

CVE-2009-0543

ProFTPD 1.3.1 with NLS support is affected by CVE-2009-0543. The vulnerability arises in handling of invalid, encoded multibyte characters in the SQL modules (mod_sql_mysql and mod_sql_postgres), allowing remote attackers to bypass SQL injection protection mechanisms. Affected components are ProF...

CVE-2009-0542

SQL injection vulnerability in ProFTPD Server 1.3.1 through 1.3.2rc2 allows remote attackers to execute arbitrary SQL commands via a "%" percent character in the username, which introduces a "'" single quote character during variable substitution by modsql...

CVE-2009-0543

ProFTPD Server 1.3.1, with NLS support enabled, allows remote attackers to bypass SQL injection protection mechanisms via invalid, encoded multibyte characters, which are not properly handled in 1 modsqlmysql and 2 modsqlpostgres...

CVE-2009-0542

SQL injection vulnerability in ProFTPD Server 1.3.1 through 1.3.2rc2 allows remote attackers to execute arbitrary SQL commands via a "%" percent character in the username, which introduces a "'" single quote character during variable substitution by modsql...

CVE-2009-0543

ProFTPD Server 1.3.1, with NLS support enabled, allows remote attackers to bypass SQL injection protection mechanisms via invalid, encoded multibyte characters, which are not properly handled in 1 modsqlmysql and 2 modsqlpostgres...

Re: Re: Another SQL injection in ProFTPd with mod_mysql (probably postgres as well)

Uh-oh, sorry, bad copy-paste..the user is just ' and 1=2 union select 1,1,uid,gid,homedir,shell from users; -- not USER ' and 1=2 union select 1,1,uid,gid,homedir,shell from users; -- I am using debian packaged proftpd 1.3.1-16 if that matters...