CVE-2009-0543 EXPLOIT
6.8
MEDIUM · CVSS 2.0 · EPSS 15.8% (pctl 97)
Patch early
A public exploit exists.
Description
ProFTPD Server 1.3.1, with NLS support enabled, allows remote attackers to bypass SQL injection protection mechanisms via invalid, encoded multibyte characters, which are not properly handled in (1) mod_sql_mysql and (2) mod_sql_postgres.
Scoring
| CVSS | 6.8 (MEDIUM, v2.0) |
|---|---|
| Vector | AV:N/AC:M/Au:N/C:P/I:P/A:P |
| EPSS | 15.77% — more likely to be exploited than 97% of all CVEs |
| Weakness | CWE-89 |
| On CISA KEV | no |
| Public exploit | yes |
| Published | 2009-02-12 |
| Last modified | 2026-06-16 |
Affected (1)
| Vendor | Product |
|---|---|
| proftpd | proftpd |
Public exploits
| Source | Title | Date |
|---|---|---|
| exploit-db | ProFTPd - 'mod_mysql' Authentication Bypass | 2009-02-10 |
References
- http://bugs.proftpd.org/show_bug.cgi?id=3173
- http://secunia.com/advisories/34268
- http://security.gentoo.org/glsa/glsa-200903-27.xml
- http://www.debian.org/security/2009/dsa-1730
- http://www.mandriva.com/security/advisories?name=MDVSA-2009:061
- http://www.openwall.com/lists/oss-security/2009/02/11/4
- http://www.openwall.com/lists/oss-security/2009/02/11/5
- http://bugs.proftpd.org/show_bug.cgi?id=3173
- http://secunia.com/advisories/34268
- http://security.gentoo.org/glsa/glsa-200903-27.xml
- http://www.debian.org/security/2009/dsa-1730
- http://www.mandriva.com/security/advisories?name=MDVSA-2009:061
- http://www.openwall.com/lists/oss-security/2009/02/11/4
- http://www.openwall.com/lists/oss-security/2009/02/11/5
→ the Explorer · watch your stack · NVD