| Package | Affected versions | Patched versions |
|---|---|---|
| proftpd | ≤ 1.3.9b |
mod_sql in ProFTPD before 1.3.9a allows remote attackers to execute arbitrary code via a username, in scenarios where there is logging of USER requests with an expansion such as %U, and the SQL backend allows commands (e.g., COPY TO PROGRAM).
Running one of these products? Scan your site to see whether it exposes a vulnerable version.
Scan my site free