CVE-2003-0500

Description

SQL injection vulnerability in the PostgreSQL authentication module (mod_sql_postgres) for ProFTPD before 1.2.9rc1 allows remote attackers to execute arbitrary SQL and gain privileges by bypassing authentication or stealing passwords via the USER name.

Affected products

• ProFTPD Project / ProFTPD1.2.9_rc1 – 1.2.9_rc1

Exploits & proofs of concept

• exploit-dbProFTPd 1.2.9 RC1 - 'mod_sql' SQL Injectionby Spaine

References

• MAILING_LISThttp://lists.grok.org.uk/pipermail/full-disclosure/2003-June/005826.html
• VENDOR_ADVISORYhttp://www.debian.org/security/2003/dsa-338