Proftpd dfsg: In ProFTPD through 1.3.9a before 7666224, a SQL injection vulnerability in sqltab_fetch_clients_cb() in contrib/mod_wrap2_sql.c allows a remote… (CVE-2026-44331)

A SQL injection vulnerability exists in ProFTPD through version 1.3.9a before commit 7666224 in the sqltab_fetch_clients_cb() function of contrib/mod_wrap2_sql.c. When UseReverseDNS is enabled, the module performs reverse DNS lookups and uses the resulting hostname directly in SQL queries without proper escaping or sanitization. This allows a remote attacker to craft a malicious domain name that, when resolved, injects arbitrary SQL commands into the backend database. The vulnerability is constrained by DNS character restrictions, which may affect the feasibility of exploitation.

Successful exploitation could lead to arbitrary SQL command execution on the backend database, potentially resulting in data disclosure, modification, or deletion. The vulnerability affects confidentiality, integrity, and availability of the affected system. The CVSS v3.1 score is 8.1, indicating a high severity impact with network attack vector, high impact on confidentiality, integrity, and availability, but requiring high attack complexity and no privileges or user interaction.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until an official fix is available, consider disabling the UseReverseDNS option to prevent the vulnerable code path from being exercised. Monitor vendor channels for updates and apply patches promptly once released.