Description
mod_sqlpw module in ProFTPD does not reset a cached password when a user uses the "user" command to change accounts, which allows authenticated attackers to gain privileges of other users.
References
- 20001211 mod_sqlpw Password Caching Bug mailing-list
- proftpd-modsqlpw-unauth-access(5737) vdb-entry