![[remote] CVE-2026-42167 - ProFTPD mod_sql post-authentication SQLi - RCE](https://media2.dev.to/dynamic/image/width=1200,height=627,fit=cover,gravity=auto,format=auto/https%3A%2F%2Fdev-to-uploads.s3.us-east-2.amazonaws.com%2Fuploads%2Farticles%2Focbqfbcqgkwpmolew2x9.png)
This article details CVE-2026-42167, a critical post-authentication SQL injection vulnerability in ProFTPD's mod_sql module that leads to Remote Code Execution (RCE). The flaw arises from a logical error in the is_escaped_text() helper function, which incorrectly treats STOR filenames beginning and ending with a single quote (and no interior quotes) as already escaped. This allows an attacker to inject and stack a second SQL statement after breaking out of the original INSERT query used for logging FTP activity.
Specifically, on PostgreSQL backends where the role is a superuser, this stacked statement can leverage COPY ... TO PROGRAM to execute arbitrary operating system commands. The exploit payload cleverly navigates FTP filename constraints, avoiding interior single quotes via dollar-quoting ($$...$$) and generating forward slashes (/) at runtime using printf's octal escape (\57). A crucial bug in widely circulated public Proof-of-Concept (PoC) code is also highlighted: printf's greedy consumption of octal digits could silently corrupt the attacker's reverse shell host/port if their first digit was 0-7, causing connection failures.
The provided Python script implements a fix for this PoC bug. Instead of directly interpolating the host/port into the printf format string, it passes them as separate arguments. This structural change ensures that no user-controlled digits are adjacent to octal escapes, preventing corruption and guaranteeing a reliable reverse shell connection. The vulnerability is classified as Critical due to its ability to achieve RCE after successful authentication.
