Evil-DB LogoEvil-DB
← All CVEs

CVE-2010-4652

medium · 6.8

Heap-based buffer overflow in the sql_prepare_where function (contrib/mod_sql.c) in ProFTPD before 1.3.3d, when mod_sql is enabled, allows remote attackers to cause a denial of service (crash) and possibly execute arbitrary code via a crafted username containing substitution tags, which are not properly handled during construction of an SQL query.

6.8
CVSS
11.3%
EPSS (exploit prob.)
96th
EPSS percentile
2011-02-02
Published

AV:N/AC:M/Au:N/C:P/I:P/A:P

Weaknesses

CWE-119

Affected products

VendorProductAffected versions
proftpdproftpd<= 1.3.3
proftpdproftpd1.2.0
proftpdproftpd1.2.0
proftpdproftpd1.2.0
proftpdproftpd1.2.0
proftpdproftpd1.2.0
proftpdproftpd1.2.0
proftpdproftpd1.2.1
proftpdproftpd1.2.2
proftpdproftpd1.2.2
proftpdproftpd1.2.2
proftpdproftpd1.2.2
proftpdproftpd1.2.3
proftpdproftpd1.2.4
proftpdproftpd1.2.5
proftpdproftpd1.2.5
proftpdproftpd1.2.5
proftpdproftpd1.2.5
proftpdproftpd1.2.6
proftpdproftpd1.2.6
proftpdproftpd1.2.6
proftpdproftpd1.2.7
proftpdproftpd1.2.7
proftpdproftpd1.2.7
proftpdproftpd1.2.7
proftpdproftpd1.2.8
proftpdproftpd1.2.8
proftpdproftpd1.2.8
proftpdproftpd1.2.9
proftpdproftpd1.2.9
proftpdproftpd1.2.9
proftpdproftpd1.2.9
proftpdproftpd1.2.10
proftpdproftpd1.2.10
proftpdproftpd1.2.10
proftpdproftpd1.2.10
proftpdproftpd1.3.0
proftpdproftpd1.3.0
proftpdproftpd1.3.0
proftpdproftpd1.3.0

Check a specific version with /api/v1/cve/match.

References

Query this programmatically:

curl https://evil-db.io/api/v1/cve/CVE-2010-4652