Exploit / PoCmedium
[remote] CVE-2026-42167 - ProFTPD mod_sql post-authentication SQLi - RCE
AI summary · glm-5.3-flashSummaries by Vani AI
Exploit-DB published a PoC for CVE-2026-42167, post-authentication SQL injection in ProFTPD mod_sql leading to remote code execution.
Exploit-DB entry 52658 provides a remote exploit for CVE-2026-42167, a SQL injection in ProFTPD's mod_sql module that is reachable after authentication and can lead to remote code execution. Successful exploitation requires valid credentials on the target FTP service.
Key facts
- CVE-2026-42167: SQL injection in ProFTPD mod_sql module
- Post-authentication requirement limits exposure to credentialed users
- SQLi escalates to remote code execution
- PoC exploit published as Exploit-DB entry 52658
- CVEs
- CVE-2026-42167
- Vendors
- ProFTPD
- Products
- ProFTPD mod_sql
- Organizations
- Exploit-DB
Vulnerabilities mentioned
All| CVE | Vulnerability | CVSS | EPSS | Signals | Published |
|---|---|---|---|---|---|
| CVE-2026-42167 | mod_sql in ProFTPD before 1.3.9a allows remote attackers to execute arbitrary code via a username, in scenarios where there is logging of USER requests with an… | 8.1 | 7% | PoC ×3 |
From the original article
CVE-2026-42167 - ProFTPD mod_sql post-authentication SQLi - RCE
exploit-db.com
A short excerpt; the article and its images belong to the publisher. Summary, key facts and assessment above are AI-written from the article and can be wrong.