CVE-2026-42167: ProFTPD mod_sql SQL Injection to RCE — Detection and Remediation Guide

A post-authentication SQL injection vulnerability in ProFTPD's mod_sql module — tracked as CVE-2026-42167 — has been published with working exploit code on Exploit-DB (EDB-ID 52658). The flaw escalates from a low-privilege FTP login to remote code execution in the context of the ProFTPD daemon, which is frequently misconfigured to run as root or with broad filesystem access. If your organization runs FTP services backed by SQL authentication — common in hosting environments, managed file transfer (MFT) workflows, and legacy vendor integrations — treat this as an immediate remediation priority.

Introduction

ProFTPD remains one of the most widely deployed FTP daemons on Linux and Unix systems, and its mod_sql module is the standard mechanism for virtual user authentication against MySQL, MariaDB, or PostgreSQL backends. CVE-2026-42167 is a post-authentication SQL injection in that module: an attacker with any valid FTP credential (including anonymous-adjacent or low-value shared accounts, or credentials harvested from a prior breach) can inject SQL syntax into queries generated by mod_sql, and under common configurations chain that injection into command execution on the host.

The publication of a public proof-of-concept dramatically lowers the exploitation bar. Post-auth does not mean low risk — FTP credentials are among the most frequently leaked, reused, and brute-forced credentials in enterprise environments, and internet-facing FTP servers are continuously scanned. Any ProFTPD instance using SQL-backed authentication that has not been patched or mitigated should be considered exposed.

Technical Analysis

Affected Component

• Product: ProFTPD FTP daemon
• Component: mod_sql module (SQL-backed authentication and user/group lookups) — including deployments using mod_sql_mysql, mod_sql_postgres, and mod_sql_sqlite connectors
• Platforms: Linux/Unix systems running ProFTPD with SQLAuthenticate on and SQL-backed virtual users
• Prerequisite for exploitation: A valid FTP account on the target (post-authentication)

How the Vulnerability Works

mod_sql translates FTP session activity — authentication, user/group lookups, and directory/file metadata queries — into SQL statements built from administrator-defined query templates (SQLUserInfo, SQLGroupInfo, SQLAuthenticate, and related directives). CVE-2026-42167 arises from insufficient sanitization of attacker-controllable input before it is concatenated into those SQL statements.

From a defender's perspective, the attack chain looks like this:

1. Authenticate to the FTP service with any valid (or compromised) credential.
2. Inject SQL syntax through an attacker-controlled field processed by mod_sql (username-derived values and session parameters passed into configured query templates are the classic injection surface).
3. Manipulate the backend query — typically to bypass result-set constraints, extract data from the authentication database, or, critically, abuse database features that bridge SQL to OS execution.
4. Escalate to code execution. On MySQL/MariaDB backends this commonly means SELECT ... INTO OUTFILE / INTO DUMPFILE to write a webshell or malicious file into a webroot or a directory executed by another service, or leveraging database-level command execution where available. On PostgreSQL, COPY ... FROM PROGRAM is the classic equivalent where pg_execute_server_program rights exist. The injected content executes with the privileges of the ProFTPD process or the downstream interpreter, not the database alone — which is why this is rated as a critical code execution flaw rather than a mere data-leak SQLi.

Why Post-Auth Is Not a Comfort Blanket

• FTP credentials are chronically weak, shared, and leaked; hosting panels and CI/CD pipelines routinely embed them.
• Many ProFTPD deployments permit account creation by non-administrators (reseller/hosting models).
• Once a single FTP account on the server is compromised via any vector, CVE-2026-42167 converts it into host-level code execution.

Exploitation Status

• Public PoC: Yes — exploit code published on Exploit-DB (EDB-ID 52658).
• CISA KEV: Monitor the KEV catalog; SQLi-to-RCE flaws with public PoCs against internet-facing services are prime candidates for rapid addition once in-the-wild exploitation is confirmed.
• Risk posture: Treat as exploitable now. Public PoC + internet-facing service + abundant leaked FTP credentials = assume scanning and opportunistic exploitation are already underway.

Detection & Response

The highest-fidelity detection signals for this class of attack are behavioral: the ProFTPD daemon (or its SQL backend) doing things an FTP server never legitimately does — writing executable files into webroots, spawning shells, or emitting SQL errors containing injection payloads.

Sigma Rules

---
title: ProFTPD Spawning Shell or Script Interpreter
description: Detects the ProFTPD daemon spawning a shell or script interpreter, consistent with post-exploitation activity following mod_sql SQLi-to-RCE (CVE-2026-42167). ProFTPD should never spawn interactive shells or interpreters in normal operation.
references:
  - https://www.exploit-db.com/exploits/52658
  - https://attack.mitre.org/techniques/T1059/
author: Security Arsenal
date: 2026/04/06
id: 3f1a7c92-8b4d-4e6f-9a21-5c7d8e9f0a1b
status: experimental
logsource:
  product: linux
  category: process_creation
detection:
  selection_parent:
    ParentImage|endswith:
      - '/proftpd'
  selection_child:
    Image|endswith:
      - '/sh'
      - '/bash'
      - '/dash'
      - '/zsh'
      - '/python'
      - '/python3'
      - '/perl'
      - '/php'
      - '/nc'
      - '/ncat'
      - '/socat'
      - '/curl'
      - '/wget'
  condition: selection_parent and selection_child
falsepositives:
  - Extremely rare custom FTP EXEC scripts; any hit warrants investigation regardless
level: critical
---
title: SQL Injection Patterns in ProFTPD Authentication Logs
description: Detects SQL injection metacharacters and keywords in FTP username/login fields recorded in ProFTPD logs, consistent with exploitation attempts against mod_sql query templates (CVE-2026-42167).
references:
  - https://www.exploit-db.com/exploits/52658
  - https://attack.mitre.org/techniques/T1190/
author: Security Arsenal
date: 2026/04/06
id: 8c2d5e71-4a9f-4b38-a614-2d6f8a0b3c4e
status: experimental
logsource:
  product: linux
  service: ftp
detection:
  selection:
    cs_username|contains:
      - ''' OR '
      - ''' AND '
      - ' UNION SELECT'
      - ' UNION ALL SELECT'
      - ' INTO OUTFILE'
      - ' INTO DUMPFILE'
      - ' FROM PROGRAM'
      - 'information_schema'
      - '-- '
      - '/*'
      - '0x'
      - 'SLEEP('
      - 'BENCHMARK('
  condition: selection
falsepositives:
  - Vulnerability scanners and sanctioned penetration tests
level: high
---
title: Suspicious File Write into Webroot by FTP or Database Process
description: Detects executable/script files written into common webroot paths by ProFTPD or database server processes, a hallmark of INTO OUTFILE/DUMPFILE webshell drops following SQLi exploitation such as CVE-2026-42167.
references:
  - https://www.exploit-db.com/exploits/52658
  - https://attack.mitre.org/techniques/T1505.003/
author: Security Arsenal
date: 2026/04/06
id: 5e9b3f46-1c7a-4d28-b953-7f4a1c6d8e2f
status: experimental
logsource:
  product: linux
  category: file_event
detection:
  selection_path:
    TargetFilename|contains:
      - '/var/www/'
      - '/srv/www/'
      - '/usr/share/nginx/'
      - '/home/*/public_html/'
  selection_ext:
    TargetFilename|endswith:
      - '.php'
      - '.phtml'
      - '.jsp'
      - '.aspx'
      - '.sh'
      - '.py'
  selection_writer:
    Image|endswith:
      - '/proftpd'
      - '/mysqld'
      - '/mariadbd'
      - '/postgres'
  condition: selection_path and selection_ext and selection_writer
falsepositives:
  - Legitimate CMS deployments; validate change tickets before dismissing
level: high

KQL (Microsoft Sentinel / Defender)

ProFTPD telemetry typically reaches Sentinel through Syslog/CEF ingestion from the Linux host or an AMA-based collector. The first query hunts for SQLi payloads in FTP usernames; the second hunts for the daemon's post-exploitation behavior.

// Hunt 1: SQLi metacharacters in FTP authentication usernames (CVE-2026-42167 probes)
Syslog
| where TimeGenerated > ago(7d)
| where Facility =~ 'ftp' or ProcessName has_any ('proftpd', 'ftpd')
| extend Msg = tostring(SyslogMessage)
| where Msg has_any ("' OR '", "' AND '", "UNION SELECT", "UNION ALL SELECT", "INTO OUTFILE", "INTO DUMPFILE", "FROM PROGRAM", "information_schema", "SLEEP(", "BENCHMARK(")
| project TimeGenerated, Computer, HostIP, ProcessName, Msg
| order by TimeGenerated desc;

// Hunt 2: ProFTPD spawning shells/interpreters/downloaders (post-exploitation)
Syslog
| where TimeGenerated > ago(7d)
| where SyslogMessage has 'proftpd'
| where SyslogMessage has_any ('/bin/sh', '/bin/bash', 'python', 'perl', 'php', 'nc ', 'ncat', 'socat', 'curl ', 'wget ')
| project TimeGenerated, Computer, HostIP, SyslogMessage
| order by TimeGenerated desc;

If you ingest auth.log/secure via SecurityEvent-mapped Linux events or Defender for Endpoint on Linux, also review DeviceProcessEvents for the same parent/child relationship (proftpd → shell).

Velociraptor VQL

Use this hunt across your Linux fleet to surface ProFTPD child processes and recently modified executable files in webroots — the two most reliable post-exploitation artifacts.

-- CVE-2026-42167 post-exploitation hunt: shells spawned under proftpd + webroot drops
LET procs = SELECT Pid, Ppid, Name, Exe, Commandline, Username
  FROM pslist()

LET proftpd_pids = SELECT Pid FROM procs WHERE Name =~ 'proftpd'

SELECT 'suspicious_child' AS Finding,
       c.Pid, c.Ppid, c.Name, c.Exe, c.Commandline, c.Username
FROM procs c
JOIN proftpd_pids p ON c.Ppid = p.Pid
WHERE c.Exe =~ '(sh|bash|dash|zsh|python|perl|php|nc|ncat|socat|curl|wget)$'

UNION ALL

SELECT 'webroot_write' AS Finding,
       NULL AS Pid, NULL AS Ppid, NULL AS Name,
       FullPath AS Exe,
       Mtime.String AS Commandline,
       NULL AS Username
FROM glob(globs=['/var/www/**/*.php', '/var/www/**/*.sh', '/var/www/**/*.py',
                 '/srv/www/**/*.php', '/usr/share/nginx/**/*.php',
                 '/home/*/public_html/**/*.php'])
WHERE Mtime > now() - 86400 * 3

Remediation & Verification Script

#!/bin/bash
# CVE-2026-42167 - ProFTPD mod_sql SQLi: verify exposure, patch, harden
set -e

echo '=== [1] Identify ProFTPD version and installed SQL modules ==='
proftpd -v 2>/dev/null || rpm -q proftpd 2>/dev/null || dpkg -l | grep -i proftpd
ls /usr/libexec/proftpd/ /usr/lib/proftpd/ 2>/dev/null | grep -i sql || true

echo '=== [2] Check whether mod_sql / SQL authentication is actually in use ==='
CONF=$(proftpd -V 2>/dev/null | awk -F': ' '/Config File/{print $2}')
echo "Config: ${CONF:-/etc/proftpd.conf}"
grep -Ei 'SQLAuthenticate|SQLAuthTypes|SQLUserInfo|SQLBackend|mod_sql' "${CONF:-/etc/proftpd.conf}" /etc/proftpd/*.conf 2>/dev/null || echo 'No mod_sql directives found.'

echo '=== [3] Apply vendor/OS security updates (get patched ProFTPD build) ==='
if command -v dnf >/dev/null; then dnf update -y proftpd
elif command -v yum >/dev/null; then yum update -y proftpd
elif command -v apt-get >/dev/null; then apt-get update && apt-get install -y --only-upgrade proftpd proftpd-mod-mysql proftpd-mod-pgsql
fi

echo '=== [4] WORKAROUND if no patch is available: disable mod_sql authentication ==='
echo '  -> Remove/comment LoadModule mod_sql*.c lines and SQLAuthenticate directives, then:'
echo '  # sed -i "s/^\s*LoadModule\s\+mod_sql/#LoadModule mod_sql/" /etc/proftpd/modules.conf'
echo '  # sed -i "s/^\s*SQLAuthenticate/#SQLAuthenticate/" /etc/proftpd.conf'

echo '=== [5] Validate config and restart ==='
proftpd -t && systemctl restart proftpd && systemctl status proftpd --no-pager | head -5

echo '=== [6] Quick compromise check: shells under proftpd and recent webroot drops ==='
ps aux | grep -i proftpd | grep -v grep
find /var/www /srv/www /home/*/public_html -name '*.php' -o -name '*.sh' 2>/dev/null | xargs -r ls -lt 2>/dev/null | head -20
last -20 | grep -i ftp || true

Remediation

Priority actions, in order:

1. Patch immediately. Update ProFTPD to the vendor-fixed release addressing CVE-2026-42167 through your OS package manager or the upstream ProFTPD project. Confirm the running binary version post-restart — package updates do not take effect until the daemon is restarted.
2. Inventory exposure. Enumerate every ProFTPD instance in your environment (internet-facing and internal) and identify which ones load mod_sql and use SQLAuthenticate on. File-backed and PAM-authenticated instances are not affected by this specific flaw but should still be on your patch cycle.
3. If you cannot patch today — disable SQL authentication. Comment out LoadModule mod_sql* lines in modules.conf and all SQL* directives, then restart. Migrate authentication to AuthUserFile/PAM temporarily. This is a complete workaround because the vulnerable code path is in mod_sql.
4. Reduce blast radius on the database side. If mod_sql must remain in use before patching: ensure the SQL user account ProFTPD connects with has minimum privileges — no FILE privilege (MySQL/MariaDB, blocks INTO OUTFILE), no superuser/pg_execute_server_program (PostgreSQL), no access to unrelated schemas, and network-restricted database connectivity.
5. Harden the daemon. Run ProFTPD as a dedicated non-root user, enforce DefaultRoot ~ chrooting, disable anonymous access, require TLS (mod_tls) to protect credentials in transit, and restrict source IPs with firewall rules or mod_wrap/TCP wrappers where feasible.
6. Credential hygiene. Rotate all FTP passwords on affected servers. Assume any credential that touched an internet-facing ProFTPD instance is known to attackers; check for reuse against other services.
7. Hunt before you patch. Given the public PoC, review 30+ days of FTP auth logs for injection patterns and webroot file drops before assuming a clean state — patching a compromised host does not evict the attacker.
8. Decommission where possible. Every engagement where we find internet-facing plain FTP, we find credential exposure. If the business function allows, migrate to SFTP/HTTPS-based managed file transfer and retire ProFTPD entirely.

Advisory references:

• Exploit-DB entry (PoC): https://www.exploit-db.com/exploits/52658
• ProFTPD project: http://www.proftpd.org/ — monitor for the security advisory and fixed release notes
• Track the CISA Known Exploited Vulnerabilities catalog for a KEV addition and any associated federal remediation deadline

Bottom Line

CVE-2026-42167 is the kind of vulnerability that quietly becomes a breach headline: an overlooked service (FTP), an overlooked module (mod_sql), and a public exploit that turns any stolen FTP password into host-level code execution. The defensive win is straightforward — patch, or disable SQL authentication, and hunt for the daemon spawning things it never should. Do all three this week.

Related Resources

Security Arsenal Penetration Testing Services AlertMonitor Platform Book a SOC Assessment vulnerability-management Intel Hub