A flaw in ProFTPD version 1.3.9a and earlier allows a remote attacker to inject arbitrary SQL commands when Reverse DNS lookups are enabled, as the hostname supplied during a lookup is passed unescaped into SQL statements within sqltab_fetch_clients_cb(). This can lead to unauthorized data disclosure, modification, or deletion, depending on the database user's privileges.

The vulnerability affects ProFTPD deployments that use the mod_wrap2_sql module, run on version 1.3.9a or earlier, and have the configuration directive 'UseReverseDNS on'. Any instance that has not applied the commit 766622456440fbca33abd7927c523673a11d1ed1 is susceptible.

With a CVSS score of 8.1 the issue is considered high severity; the EPSS score is not available and the vulnerability is not listed in the CISA KEV catalog. The likely attack vector is remote, requiring an attacker to craft a domain name containing malicious SQL and trigger a reverse DNS lookup performed by the FTP server. Although DNS name character restrictions may limit payload length, an attacker can still inject effective SQL statements if the database user has sufficient privileges.