Threats tagged 'ghsa-jmg2-v72j-gmvc'

A SQL injection vulnerability exists in ProFTPD versions through 1.3.9a before commit 7666224 in the sqltab_fetch_clients_cb() function within contrib/mod_wrap2_sql.c. This flaw allows remote attackers to inject arbitrary SQL commands via a crafted domain name during reverse DNS lookups when the UseReverseDNS option is enabled. The vulnerability arises because the attacker-controlled hostname is passed unescaped into SQL queries. DNS name character restrictions may limit exploitability.