Some vulnerabilities have been reported in ProFTPD, which can be exploited by malicious people to conduct SQL injection attacks.

1) The application improperly sets the character encoding prior to performing SQL queries. This can be exploited to manipulate SQL queries by injecting arbitrary SQL code in an environment using a multi-byte character encoding.

Successful exploitation requires that NLS support is enabled.

The vulnerability is reported in version 1.3.1 and later.

2) An error exists in the "mod_sql" module when processing e.g. user names containing '%' characters. This can be exploited to bypass input sanitation routines and manipulate SQL queries by injecting arbitrary SQL code.

The vulnerability is reported in versions prior to 1.3.2rc3.

Solution
Update to version 1.3.2.

Provided and/or discovered by
1) Reported by the vendor.
2) Originally reported via a ProFTPD bug report. Reported as a vulnerability by gat3way.

Changelog
Further details available to Secunia VIM customers

Original Advisory
1) http://bugs.proftpd.org/show_bug.cgi?id=3173
2) http://bugs.proftpd.org/show_bug.cgi?id=3124
http://milw0rm.com/exploits/8037

Deep Links
Links available to Secunia VIM customers