CVE-2004-1573 - The documentation for AJ-Fork 167 implies that users should set permissions for users.db.php to 777,

CVE-2004-1573

Summary

The documentation for AJ-Fork 167 implies that users should set permissions for users.db.php to 777, which allows local users to execute arbitrary PHP code and gain privileges as the administrator.

References

Vulnerable Configurations

cpe:2.3:a:aj-fork:aj-fork:167:*:*:*:*:*:*:*
cpe:2.3:a:aj-fork:aj-fork:167:*:*:*:*:*:*:*
cpe:2.3:a:cutephp:cutenews:0.88:*:*:*:*:*:*:*
cpe:2.3:a:cutephp:cutenews:0.88:*:*:*:*:*:*:*
cpe:2.3:a:cutephp:cutenews:1.3:*:*:*:*:*:*:*
cpe:2.3:a:cutephp:cutenews:1.3:*:*:*:*:*:*:*
cpe:2.3:a:cutephp:cutenews:1.3.1:*:*:*:*:*:*:*
cpe:2.3:a:cutephp:cutenews:1.3.1:*:*:*:*:*:*:*
cpe:2.3:a:cutephp:cutenews:1.3.2:*:*:*:*:*:*:*
cpe:2.3:a:cutephp:cutenews:1.3.2:*:*:*:*:*:*:*
cpe:2.3:a:cutephp:cutenews:1.3.6:*:*:*:*:*:*:*
cpe:2.3:a:cutephp:cutenews:1.3.6:*:*:*:*:*:*:*

CVSS

Base:	7.2 (as of 11-07-2017 - 01:31)
Impact:
Exploitability:

CWE

NVD-CWE-Other

CAPEC

Access

Vector	Complexity	Authentication
LOCAL	LOW	NONE

Impact

Confidentiality	Integrity	Availability
COMPLETE	COMPLETE	COMPLETE

cvss-vector via4

AV:L/AC:L/Au:N/C:C/I:C/A:C

refmap via4

bid	11301
bugtraq	20041001 Multiple Vulnerabilities in AJ-Fork
misc	http://echo.or.id/adv/adv07-y3dips-2004.txt
sectrack	1011484
xf	aj-fork-usersdbphp-write-access(17571)

Last major update

11-07-2017 - 01:31

Published

31-12-2004 - 05:00

Last modified

11-07-2017 - 01:31