10.0
CRITICAL
CVE-2015-3306
ProFTPD Unauthenticated File Read/Write Vulnerability
Description

The mod_copy module in ProFTPD 1.3.5 allows remote attackers to read and write to arbitrary files via the site cpfr and site cpto commands.

INFO

Published Date :

May 18, 2015, 3:59 p.m.

Last Modified :

April 12, 2025, 10:46 a.m.

Remotely Exploitable :

Yes !

Impact Score :

10.0

Exploitability Score :

10.0
Public PoC/Exploit Available at Github

CVE-2015-3306 has a 54 public PoC/Exploit available at Github. Go to the Public Exploits tab to see the list.

Affected Products

The following products are affected by CVE-2015-3306 vulnerability. Even if cvefeed.io is aware of the exact versions of the products that are affected, the information is not represented in the table below.

ID Vendor Product Action
1 Proftpd proftpd
References to Advisories, Solutions, and Tools

Here, you will find a curated list of external links that provide in-depth information, practical solutions, and valuable tools related to CVE-2015-3306.

URL Resource
http://lists.fedoraproject.org/pipermail/package-announce/2015-May/157053.html
http://lists.fedoraproject.org/pipermail/package-announce/2015-May/157054.html
http://lists.fedoraproject.org/pipermail/package-announce/2015-May/157581.html
http://lists.opensuse.org/opensuse-updates/2015-06/msg00020.html
http://packetstormsecurity.com/files/131505/ProFTPd-1.3.5-File-Copy.html
http://packetstormsecurity.com/files/131555/ProFTPd-1.3.5-Remote-Command-Execution.html
http://packetstormsecurity.com/files/131567/ProFTPd-CPFR-CPTO-Proof-Of-Concept.html
http://packetstormsecurity.com/files/132218/ProFTPD-1.3.5-Mod_Copy-Command-Execution.html
http://packetstormsecurity.com/files/162777/ProFTPd-1.3.5-Remote-Command-Execution.html
http://www.debian.org/security/2015/dsa-3263
http://www.rapid7.com/db/modules/exploit/unix/ftp/proftpd_modcopy_exec
http://www.securityfocus.com/bid/74238
https://www.exploit-db.com/exploits/36742/ Exploit
https://www.exploit-db.com/exploits/36803/ Exploit
http://lists.fedoraproject.org/pipermail/package-announce/2015-May/157053.html
http://lists.fedoraproject.org/pipermail/package-announce/2015-May/157054.html
http://lists.fedoraproject.org/pipermail/package-announce/2015-May/157581.html
http://lists.opensuse.org/opensuse-updates/2015-06/msg00020.html
http://packetstormsecurity.com/files/131505/ProFTPd-1.3.5-File-Copy.html
http://packetstormsecurity.com/files/131555/ProFTPd-1.3.5-Remote-Command-Execution.html
http://packetstormsecurity.com/files/131567/ProFTPd-CPFR-CPTO-Proof-Of-Concept.html
http://packetstormsecurity.com/files/132218/ProFTPD-1.3.5-Mod_Copy-Command-Execution.html
http://packetstormsecurity.com/files/162777/ProFTPd-1.3.5-Remote-Command-Execution.html
http://www.debian.org/security/2015/dsa-3263
http://www.rapid7.com/db/modules/exploit/unix/ftp/proftpd_modcopy_exec
http://www.securityfocus.com/bid/74238
https://www.exploit-db.com/exploits/36742/ Exploit
https://www.exploit-db.com/exploits/36803/ Exploit

We scan GitHub repositories to detect new proof-of-concept exploits. Following list is a collection of public exploits and proof-of-concepts, which have been published on GitHub (sorted by the most recently updated).

None

JavaScript

Updated: 5 days, 18 hours ago
1 stars 0 fork 0 watcher
Born at : June 21, 2025, 5:34 a.m. This repo has been linked 1 different CVEs too.

End-to-end penetration testing on a vulnerable Ubuntu VM using Nmap, Nessus, Metasploit, and Hashcat. Includes exploitation, privilege escalation, and password cracking.

Updated: 1 week, 2 days ago
0 stars 0 fork 0 watcher
Born at : June 17, 2025, 1:32 a.m. This repo has been linked 1 different CVEs too.

This contains single-file exploit for ProFTPd 1.3.5 mod_copy (CVE-2015-3306) vulnerability, especially for TryHackMe Kenobi Lab.

Python

Updated: 1 month, 1 week ago
0 stars 0 fork 0 watcher
Born at : May 14, 2025, 6:13 a.m. This repo has been linked 1 different CVEs too.

A comprehensive system hardening project on Metasploitable 3 using Wazuh SIEM, vulnerability scanning (OpenVAS, Nessus), and remediation of critical security flaws.

Updated: 1 month, 2 weeks ago
0 stars 0 fork 0 watcher
Born at : May 10, 2025, 10:31 p.m. This repo has been linked 4 different CVEs too.

Pentest report detailing discovered vulnerabilities and exploits on Metasploitable 3 using tools various Tools

Updated: 1 month, 2 weeks ago
0 stars 0 fork 0 watcher
Born at : May 10, 2025, 10:13 p.m. This repo has been linked 4 different CVEs too.

监控Github最新网络安全相关的仓库...

cve cybersecurity github spider

Shell Python Nix

Updated: 1 month, 1 week ago
0 stars 1 fork 1 watcher
Born at : May 9, 2025, 2:29 p.m. This repo has been linked 28 different CVEs too.

A cross-platform Python vulnerability scanner that detects open ports, weak credentials, and CVEs using banner matching. Fast, extensible, and beginner-friendly.

Python

Updated: 2 months, 3 weeks ago
0 stars 0 fork 0 watcher
Born at : April 4, 2025, 2:09 p.m. This repo has been linked 26 different CVEs too.

My Personal Portfolio v1.0

Updated: 3 months, 3 weeks ago
0 stars 0 fork 0 watcher
Born at : March 2, 2025, 11:22 p.m. This repo has been linked 1 different CVEs too.

None

Python

Updated: 7 months, 1 week ago
0 stars 0 fork 0 watcher
Born at : Nov. 20, 2024, 7:46 p.m. This repo has been linked 1 different CVEs too.

None

Dockerfile Python Shell

Updated: 9 months ago
0 stars 0 fork 0 watcher
Born at : Sept. 23, 2024, 7:08 a.m. This repo has been linked 1 different CVEs too.

Laboratorios para las formaciones de Ethical Hacking

Python PowerShell

Updated: 1 year ago
0 stars 2 fork 2 watcher
Born at : June 10, 2024, 6:36 p.m. This repo has been linked 2 different CVEs too.

None

PowerShell Python

Updated: 6 months, 3 weeks ago
0 stars 0 fork 0 watcher
Born at : June 7, 2024, 9:06 a.m. This repo has been linked 2 different CVEs too.

None

Updated: 1 year, 1 month ago
0 stars 0 fork 0 watcher
Born at : May 6, 2024, 7:01 p.m. This repo has been linked 3 different CVEs too.

Script that exploits the vulnerability of the ProFTPd 1.3.5 service with CVE-2015-3306

Python

Updated: 1 year, 2 months ago
0 stars 0 fork 0 watcher
Born at : April 18, 2024, 6:05 p.m. This repo has been linked 1 different CVEs too.

Walkthroughs and notes of 'boot to root' CTFs mostly from VulnHub that I did for learning Pentesting.

Updated: 1 year, 5 months ago
0 stars 0 fork 0 watcher
Born at : Jan. 27, 2024, 10:10 a.m. This repo has been linked 17 different CVEs too.

Results are limited to the first 15 repositories due to potential performance issues.

The following list is the news that have been mention CVE-2015-3306 vulnerability anywhere in the article.

The following table lists the changes that have been made to the CVE-2015-3306 vulnerability over time.

Vulnerability history details can be useful for understanding the evolution of a vulnerability, and for identifying the most recent changes that may impact the vulnerability's severity, exploitability, or other characteristics.

  • CVE Modified by af854a3a-2127-422b-91ae-364da2661108

    Nov. 21, 2024

    Action Type Old Value New Value
    Added Reference http://lists.fedoraproject.org/pipermail/package-announce/2015-May/157053.html
    Added Reference http://lists.fedoraproject.org/pipermail/package-announce/2015-May/157054.html
    Added Reference http://lists.fedoraproject.org/pipermail/package-announce/2015-May/157581.html
    Added Reference http://lists.opensuse.org/opensuse-updates/2015-06/msg00020.html
    Added Reference http://packetstormsecurity.com/files/131505/ProFTPd-1.3.5-File-Copy.html
    Added Reference http://packetstormsecurity.com/files/131555/ProFTPd-1.3.5-Remote-Command-Execution.html
    Added Reference http://packetstormsecurity.com/files/131567/ProFTPd-CPFR-CPTO-Proof-Of-Concept.html
    Added Reference http://packetstormsecurity.com/files/132218/ProFTPD-1.3.5-Mod_Copy-Command-Execution.html
    Added Reference http://packetstormsecurity.com/files/162777/ProFTPd-1.3.5-Remote-Command-Execution.html
    Added Reference http://www.debian.org/security/2015/dsa-3263
    Added Reference http://www.rapid7.com/db/modules/exploit/unix/ftp/proftpd_modcopy_exec
    Added Reference http://www.securityfocus.com/bid/74238
    Added Reference https://www.exploit-db.com/exploits/36742/
    Added Reference https://www.exploit-db.com/exploits/36803/
  • CVE Modified by [email protected]

    May. 14, 2024

    Action Type Old Value New Value
  • CVE Modified by [email protected]

    May. 26, 2021

    Action Type Old Value New Value
    Added Reference http://packetstormsecurity.com/files/162777/ProFTPd-1.3.5-Remote-Command-Execution.html [No Types Assigned]
  • CVE Modified by [email protected]

    Jan. 03, 2017

    Action Type Old Value New Value
    Added Reference http://www.debian.org/security/2015/dsa-3263 [No Types Assigned]
  • CVE Modified by [email protected]

    Dec. 31, 2016

    Action Type Old Value New Value
    Added Reference http://lists.opensuse.org/opensuse-updates/2015-06/msg00020.html [No Types Assigned]
  • CVE Modified by [email protected]

    Dec. 22, 2016

    Action Type Old Value New Value
    Added Reference http://www.rapid7.com/db/modules/exploit/unix/ftp/proftpd_modcopy_exec [No Types Assigned]
  • CVE Modified by [email protected]

    Dec. 03, 2016

    Action Type Old Value New Value
    Added Reference http://packetstormsecurity.com/files/132218/ProFTPD-1.3.5-Mod_Copy-Command-Execution.html [No Types Assigned]
    Added Reference http://packetstormsecurity.com/files/131505/ProFTPd-1.3.5-File-Copy.html [No Types Assigned]
    Added Reference http://packetstormsecurity.com/files/131555/ProFTPd-1.3.5-Remote-Command-Execution.html [No Types Assigned]
    Added Reference http://packetstormsecurity.com/files/131567/ProFTPd-CPFR-CPTO-Proof-Of-Concept.html [No Types Assigned]
  • CVE Modified by [email protected]

    Jun. 04, 2015

    Action Type Old Value New Value
    Added Reference http://www.securityfocus.com/bid/74238
  • Modified Analysis by [email protected]

    May. 19, 2015

    Action Type Old Value New Value
    Added CPE Configuration Configuration 1 OR *cpe:2.3:a:proftpd:proftpd:1.3.5:*:*:*:*:*:*:*
    Added CVSS V2 (AV:N/AC:L/Au:N/C:C/I:C/A:C)
    Changed Reference Type https://www.exploit-db.com/exploits/36803/ No Types Assigned https://www.exploit-db.com/exploits/36803/ Exploit
    Changed Reference Type https://www.exploit-db.com/exploits/36742/ No Types Assigned https://www.exploit-db.com/exploits/36742/ Exploit
    Added CWE CWE-284
  • Initial Analysis by [email protected]

    May. 19, 2015

    Action Type Old Value New Value
EPSS is a daily estimate of the probability of exploitation activity being observed over the next 30 days. Following chart shows the EPSS score history of the vulnerability.
CWE - Common Weakness Enumeration

While CVE identifies specific instances of vulnerabilities, CWE categorizes the common flaws or weaknesses that can lead to vulnerabilities. CVE-2015-3306 is associated with the following CWEs:

Exploit Prediction

EPSS is a daily estimate of the probability of exploitation activity being observed over the next 30 days.

94.07 }} -0.08%

score

0.99888

percentile

CVSS2 - Vulnerability Scoring System
Access Vector
Access Complexity
Authentication
Confidentiality
Integrity
Availability
© cvefeed.io
Latest DB Update: Jun. 28, 2025 1:09