$ cve CVE-2006-6563 JSON

CVE-2006-6563 EXPLOIT

6.6

MEDIUM · CVSS 2.0 · EPSS 2.3% (pctl 83)

Patch early

A public exploit exists.

Description

Stack-based buffer overflow in the pr_ctrls_recv_request function in ctrls.c in the mod_ctrls module in ProFTPD before 1.3.1rc1 allows local users to execute arbitrary code via a large reqarglen length value.

Scoring

CVSS	6.6 (MEDIUM, v2.0)
Vector	AV:L/AC:M/Au:S/C:C/I:C/A:C
EPSS	2.33% — more likely to be exploited than 83% of all CVEs
On CISA KEV	no
Public exploit	yes
Published	2006-12-15
Last modified	2026-06-16

Affected (1)

Vendor	Product
proftpd project	proftpd

Public exploits

Source	Title	Date
exploit-db	ProFTPd 1.3.0/1.3.0a - 'mod_ctrls' 'support' Local Buffer Overflow (2)	2007-02-19
exploit-db	ProFTPd 1.3.0/1.3.0a - 'mod_ctrls' 'support' Local Buffer Overflow (1)	2007-02-18
exploit-db	ProFTPd 1.3.0a - 'mod_ctrls' 'support' Local Buffer Overflow (PoC)	2006-12-13
exploit-db	ProFTPd - 'ftpdctl' 'pr_ctrls_connect' Local Overflow	2004-08-13

References

→ the Explorer · watch your stack · NVD