## https://sploitus.com/exploit?id=SAINT:63FB77B9136D48259E4F0D4CDA35E957
Added: 05/29/2015
CVE: [CVE-2015-3306](<https://vulners.com/cve/CVE-2015-3306>)
BID: [74238](<http://www.securityfocus.com/bid/74238>)
OSVDB: [120834](<http://www.osvdb.org/120834>)
### Background
[ProFTPD](<http://www.proftpd.org/>) is free FTP Server software for Unix and Linux platforms.
### Problem
The mod_copy extension, if enabled in ProFTPD, allows unauthenticated attackers to read and write arbitrary files using the `**SITE CPFR**` and `**SITE CPTO**` commands. This can lead to arbitrary command execution if the system also runs a web server supporting PHP.
### Resolution
[Upgrade](<ftp://ftp.proftpd.org/distrib/source/>) to ProFTPD 1.3.5a or 1.3.6rc1 or higher, or install a package update from your Linux vendor.
### References
<http://bugs.proftpd.org/show_bug.cgi?id=4169>
### Limitations
Exploit works on ProFTPD 1.3.5 and requires the mod_copy module to be enabled.
The target must also run a web server supporting PHP in order for the exploit to succeed.
### Platforms
Linux