Exploitation Summary
EIP tracks 2 public exploits for CVE-2009-0542. PoCs published by gat3way, AlpHaNiX.
AI-analyzed exploit summary This writeup describes an SQL injection vulnerability in ProFTPD's SQL authentication mechanism. The exploit leverages improper handling of the '%' character to bypass authentication by injecting a malicious SQL query into the username field.
Description
SQL injection vulnerability in ProFTPD Server 1.3.1 through 1.3.2rc2 allows remote attackers to execute arbitrary SQL commands via a "%" (percent) character in the username, which introduces a "'" (single quote) character during variable substitution by mod_sql.
Exploits (2)
This writeup describes an SQL injection vulnerability in ProFTPD's SQL authentication mechanism. The exploit leverages improper handling of the '%' character to bypass authentication by injecting a malicious SQL query into the username field.
This exploit leverages an SQL injection vulnerability in ProFTPD with mod_mysql to bypass authentication. It allows an attacker to execute FTP commands such as listing, deleting, renaming files, and creating directories without valid credentials.