Search for vulnerabilities
Vulnerability details: VCID-yadu-nzbq-aaap
Vulnerability ID VCID-yadu-nzbq-aaap
Aliases CVE-2009-0542
Summary SQL injection vulnerability in ProFTPD Server 1.3.1 through 1.3.2rc2 allows remote attackers to execute arbitrary SQL commands via a "%" (percent) character in the username, which introduces a "'" (single quote) character during variable substitution by mod_sql.
Status Published
Exploitability 2.0
Weighted Severity 9.0
Risk 10.0
Affected and Fixed Packages Package Details
Weaknesses (1)
CWE-89 Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection')
System Score Found at
epss 0.2968 https://api.first.org/data/v1/epss?cve=CVE-2009-0542
epss 0.2968 https://api.first.org/data/v1/epss?cve=CVE-2009-0542
epss 0.2968 https://api.first.org/data/v1/epss?cve=CVE-2009-0542
epss 0.2968 https://api.first.org/data/v1/epss?cve=CVE-2009-0542
epss 0.2968 https://api.first.org/data/v1/epss?cve=CVE-2009-0542
epss 0.2968 https://api.first.org/data/v1/epss?cve=CVE-2009-0542
epss 0.2968 https://api.first.org/data/v1/epss?cve=CVE-2009-0542
epss 0.2968 https://api.first.org/data/v1/epss?cve=CVE-2009-0542
epss 0.2968 https://api.first.org/data/v1/epss?cve=CVE-2009-0542
epss 0.2968 https://api.first.org/data/v1/epss?cve=CVE-2009-0542
epss 0.2968 https://api.first.org/data/v1/epss?cve=CVE-2009-0542
epss 0.2968 https://api.first.org/data/v1/epss?cve=CVE-2009-0542
epss 0.2968 https://api.first.org/data/v1/epss?cve=CVE-2009-0542
epss 0.2968 https://api.first.org/data/v1/epss?cve=CVE-2009-0542
epss 0.2968 https://api.first.org/data/v1/epss?cve=CVE-2009-0542
epss 0.2968 https://api.first.org/data/v1/epss?cve=CVE-2009-0542
epss 0.2968 https://api.first.org/data/v1/epss?cve=CVE-2009-0542
epss 0.2968 https://api.first.org/data/v1/epss?cve=CVE-2009-0542
epss 0.2968 https://api.first.org/data/v1/epss?cve=CVE-2009-0542
epss 0.2968 https://api.first.org/data/v1/epss?cve=CVE-2009-0542
epss 0.2968 https://api.first.org/data/v1/epss?cve=CVE-2009-0542
epss 0.2968 https://api.first.org/data/v1/epss?cve=CVE-2009-0542
epss 0.2968 https://api.first.org/data/v1/epss?cve=CVE-2009-0542
epss 0.2968 https://api.first.org/data/v1/epss?cve=CVE-2009-0542
epss 0.2968 https://api.first.org/data/v1/epss?cve=CVE-2009-0542
epss 0.2968 https://api.first.org/data/v1/epss?cve=CVE-2009-0542
epss 0.2968 https://api.first.org/data/v1/epss?cve=CVE-2009-0542
epss 0.2968 https://api.first.org/data/v1/epss?cve=CVE-2009-0542
epss 0.2968 https://api.first.org/data/v1/epss?cve=CVE-2009-0542
epss 0.2968 https://api.first.org/data/v1/epss?cve=CVE-2009-0542
epss 0.2968 https://api.first.org/data/v1/epss?cve=CVE-2009-0542
epss 0.2968 https://api.first.org/data/v1/epss?cve=CVE-2009-0542
epss 0.64085 https://api.first.org/data/v1/epss?cve=CVE-2009-0542
epss 0.64085 https://api.first.org/data/v1/epss?cve=CVE-2009-0542
epss 0.64085 https://api.first.org/data/v1/epss?cve=CVE-2009-0542
epss 0.64085 https://api.first.org/data/v1/epss?cve=CVE-2009-0542
epss 0.64085 https://api.first.org/data/v1/epss?cve=CVE-2009-0542
epss 0.64085 https://api.first.org/data/v1/epss?cve=CVE-2009-0542
epss 0.64085 https://api.first.org/data/v1/epss?cve=CVE-2009-0542
epss 0.64085 https://api.first.org/data/v1/epss?cve=CVE-2009-0542
epss 0.64085 https://api.first.org/data/v1/epss?cve=CVE-2009-0542
epss 0.64085 https://api.first.org/data/v1/epss?cve=CVE-2009-0542
epss 0.64085 https://api.first.org/data/v1/epss?cve=CVE-2009-0542
epss 0.64085 https://api.first.org/data/v1/epss?cve=CVE-2009-0542
epss 0.64085 https://api.first.org/data/v1/epss?cve=CVE-2009-0542
epss 0.64085 https://api.first.org/data/v1/epss?cve=CVE-2009-0542
epss 0.64085 https://api.first.org/data/v1/epss?cve=CVE-2009-0542
epss 0.64085 https://api.first.org/data/v1/epss?cve=CVE-2009-0542
epss 0.64085 https://api.first.org/data/v1/epss?cve=CVE-2009-0542
epss 0.64085 https://api.first.org/data/v1/epss?cve=CVE-2009-0542
epss 0.64085 https://api.first.org/data/v1/epss?cve=CVE-2009-0542
epss 0.67942 https://api.first.org/data/v1/epss?cve=CVE-2009-0542
epss 0.92672 https://api.first.org/data/v1/epss?cve=CVE-2009-0542
epss 0.92672 https://api.first.org/data/v1/epss?cve=CVE-2009-0542
epss 0.92672 https://api.first.org/data/v1/epss?cve=CVE-2009-0542
epss 0.92672 https://api.first.org/data/v1/epss?cve=CVE-2009-0542
epss 0.92672 https://api.first.org/data/v1/epss?cve=CVE-2009-0542
epss 0.92672 https://api.first.org/data/v1/epss?cve=CVE-2009-0542
epss 0.92672 https://api.first.org/data/v1/epss?cve=CVE-2009-0542
epss 0.92672 https://api.first.org/data/v1/epss?cve=CVE-2009-0542
epss 0.92672 https://api.first.org/data/v1/epss?cve=CVE-2009-0542
epss 0.92672 https://api.first.org/data/v1/epss?cve=CVE-2009-0542
epss 0.92672 https://api.first.org/data/v1/epss?cve=CVE-2009-0542
epss 0.92672 https://api.first.org/data/v1/epss?cve=CVE-2009-0542
epss 0.92672 https://api.first.org/data/v1/epss?cve=CVE-2009-0542
epss 0.92672 https://api.first.org/data/v1/epss?cve=CVE-2009-0542
rhbs urgent https://bugzilla.redhat.com/show_bug.cgi?id=485125
cvssv2 7.5 https://nvd.nist.gov/vuln/detail/CVE-2009-0542
Reference id Reference type URL
http://bugs.proftpd.org/show_bug.cgi?id=3180
https://access.redhat.com/hydra/rest/securitydata/cve/CVE-2009-0542.json
https://api.first.org/data/v1/epss?cve=CVE-2009-0542
https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2009-0542
http://secunia.com/advisories/34268
http://security.gentoo.org/glsa/glsa-200903-27.xml
https://www.exploit-db.com/exploits/8037
http://www.debian.org/security/2009/dsa-1730
http://www.mandriva.com/security/advisories?name=MDVSA-2009:061
http://www.openwall.com/lists/oss-security/2009/02/11/1
http://www.openwall.com/lists/oss-security/2009/02/11/3
http://www.openwall.com/lists/oss-security/2009/02/11/5
http://www.securityfocus.com/archive/1/500823/100/0/threaded
http://www.securityfocus.com/archive/1/500833/100/0/threaded
http://www.securityfocus.com/archive/1/500851/100/0/threaded
http://www.securityfocus.com/archive/1/500852/100/0/threaded
485125 https://bugzilla.redhat.com/show_bug.cgi?id=485125
516388 https://bugs.debian.org/cgi-bin/bugreport.cgi?bug=516388
cpe:2.3:a:proftpd_project:proftpd:1.3.1:*:*:*:*:*:*:* https://nvd.nist.gov/vuln/search/results?adv_search=true&isCpeNameSearch=true&query=cpe:2.3:a:proftpd_project:proftpd:1.3.1:*:*:*:*:*:*:*
cpe:2.3:a:proftpd_project:proftpd:1.3.2:*:*:*:*:*:*:* https://nvd.nist.gov/vuln/search/results?adv_search=true&isCpeNameSearch=true&query=cpe:2.3:a:proftpd_project:proftpd:1.3.2:*:*:*:*:*:*:*
cpe:2.3:a:proftpd_project:proftpd:1.3.2_rc2:*:*:*:*:*:*:* https://nvd.nist.gov/vuln/search/results?adv_search=true&isCpeNameSearch=true&query=cpe:2.3:a:proftpd_project:proftpd:1.3.2_rc2:*:*:*:*:*:*:*
CVE-2009-0542 https://nvd.nist.gov/vuln/detail/CVE-2009-0542
CVE-2009-0542;OSVDB-51953 Exploit https://gitlab.com/exploit-database/exploitdb/-/blob/main/exploits/multiple/remote/32798.pl
CVE-2009-0542;OSVDB-51953 Exploit https://www.securityfocus.com/bid/33722/info
GLSA-200903-27 https://security.gentoo.org/glsa/200903-27
OSVDB-51953;CVE-2009-0543;OSVDB-51849;CVE-2009-0542 Exploit https://gitlab.com/exploit-database/exploitdb/-/blob/main/exploits/multiple/remote/8037.txt
Data source Exploit-DB
Date added Feb. 10, 2009
Description ProFTPd 1.3 - 'mod_sql' 'Username' SQL Injection
Ransomware campaign use Known
Source publication date Feb. 10, 2009
Exploit type remote
Platform multiple
Source update date April 11, 2014
Source URL https://www.securityfocus.com/bid/33722/info
Vector: AV:N/AC:L/Au:N/C:P/I:P/A:P Found at https://nvd.nist.gov/vuln/detail/CVE-2009-0542
Exploitability (E) Access Vector (AV) Access Complexity (AC) Authentication (Au) Confidentiality Impact (C) Integrity Impact (I) Availability Impact (A)

high

functional

unproven

proof_of_concept

not_defined

local

adjacent_network

network

high

medium

low

multiple

single

none

none

partial

complete

none

partial

complete

none

partial

complete
Exploit Prediction Scoring System (EPSS)
Percentile 0.96349
EPSS Score 0.2968
Published At May 1, 2025, 12:55 p.m.
Date Actor Action Source VulnerableCode Version
There are no relevant records.