CVE-2026-42167

This repository contains a functional exploit for CVE-2026-42167, demonstrating a pre-authentication RCE in ProFTPD via SQL injection in the mod_sql module. The exploit leverages PostgreSQL's COPY TO PROGRAM directive to exfiltrate file contents or establish a reverse shell.

This repository contains functional exploit code for CVE-2026-42167, a SQL injection vulnerability in ProFTPD's mod_sql module. The PoC demonstrates unauthenticated RCE and auth bypass via crafted USER and STOR commands, leveraging a flawed is_escaped_text() heuristic.

The repository contains functional exploit code demonstrating CVE-2026-42167, a SQL injection vulnerability in ProFTPD's mod_sql logging pipeline. The PoCs leverage a bypass in the is_escaped_text() function to execute arbitrary SQL queries, enabling backdoor user injection and remote code execution via PostgreSQL's COPY TO PROGRAM feature.