CoreCVE
Back

HIGH

In ProFTPD through 1.3.9a before 7666224, a SQL injection vulnerability in sqltab_fetch_clients_cb() in contrib/mod_wrap2_sql.c allows a remote attacker to inject arbitrary SQL commands via a crafted domain name that is accessed in a reverse DNS lookup

Published May 5, 2026

Description

In ProFTPD through 1.3.9a before 7666224, a SQL injection vulnerability in sqltab_fetch_clients_cb() in contrib/mod_wrap2_sql.c allows a remote attacker to inject arbitrary SQL commands via a crafted domain name that is accessed in a reverse DNS lookup. When "UseReverseDNS on" is enabled, the attacker-supplied hostname is passed unescaped into SQL queries. The character restrictions of DNS names may affect exploitability.

Affected products

Remediation

No remediation recorded yet.

Metrics

Weaknesses (1)

CWE-89

SQL Injection

References (2)

Change history (0)

No recorded changes yet.

Sources
CVE.org / MITRE
Status PUBLISHED
Assigner mitre
Published May 5, 2026
Updated May 6, 2026
Reserved May 5, 2026
Link CVE-2026-44331
CISA Vulnrichment
Updated May 6, 2026
NVD
Status Awaiting Analysis
Modified Jul 24, 2026
Link CVE-2026-44331
Red Hat
Severity n/a
Public date n/a
Links CVE-2026-44331