A critical SQL injection vulnerability in ProFTPD allows unauthenticated remote attackers to achieve remote code execution, posing a severe risk to server integrity.

The flaw exists in the mod_sql module, where improper neutralization of SQL special elements occurs during the logging of USER requests. This allows an unauthenticated remote attacker to inject malicious commands into the SQL backend, leading to arbitrary code execution if the backend configuration supports command execution (e.g., via COPY TO PROGRAM).

The ability for an unauthenticated attacker to execute arbitrary code on a server hosting file transfer services represents a total compromise of the affected system. This vulnerability carries a CVSS score of 8.1, reflecting the high risk of full system takeover, data theft, and potential lateral movement within the network.

Immediate Action: Update the ProFTPD installation to version 1.3.9a or later immediately to incorporate the necessary security patches.

Proactive Monitoring: Audit server logs for unusual USER request strings containing SQL expansion characters or patterns indicative of command injection attempts.

Compensating Controls: Implement a Web Application Firewall or database firewall rules to block suspicious inbound traffic containing SQL-related special characters directed at the FTP service.

Public Exploit Available: Yes, a public exploit is available via ExploitDB entries and public proof-of-concept repositories on GitHub.

Given the availability of public exploits and the high-impact nature of remote code execution, this vulnerability poses an immediate and severe risk. Organizations must prioritize patching ProFTPD to the latest version to prevent unauthorized system access and ensure the continued security of their infrastructure.