« Volver al listado

CVE-2004-1573

Estado: ModificadaAlta (7.2)—

The documentation for AJ-Fork 167 implies that users should set permissions for users.db.php to 777, which allows local users to execute arbitrary PHP code and gain privileges as the administrator.

CVSS

Probabilidad de explotación (EPSS)

EPSS (Exploit Prediction Scoring System, de FIRST) estima la probabilidad de que una vulnerabilidad sea explotada en 30 días. Complementa a CVSS (impacto) y a CISA KEV (explotación confirmada).

Tecnologías afectadas (2)

Aj-fork — Aj-forkCutephp — Cutenews

CWE

Referencias

JSON original (NVD)

Mostrar
{
  "id": "CVE-2004-1573",
  "cveTags": [],
  "metrics": {
    "cvssMetricV2": [
      {
        "type": "Primary",
        "source": "nvd@nist.gov",
        "cvssData": {
          "version": "2.0",
          "baseScore": 7.2,
          "accessVector": "LOCAL",
          "vectorString": "AV:L/AC:L/Au:N/C:C/I:C/A:C",
          "authentication": "NONE",
          "integrityImpact": "COMPLETE",
          "accessComplexity": "LOW",
          "availabilityImpact": "COMPLETE",
          "confidentialityImpact": "COMPLETE"
        },
        "acInsufInfo": false,
        "impactScore": 10,
        "baseSeverity": "HIGH",
        "obtainAllPrivilege": true,
        "exploitabilityScore": 3.9,
        "obtainUserPrivilege": false,
        "obtainOtherPrivilege": false,
        "userInteractionRequired": false
      }
    ]
  },
  "affected": [
    {
      "source": "cve@mitre.org",
      "affectedData": [
        {
          "vendor": "n/a",
          "product": "n/a",
          "versions": [
            {
              "status": "affected",
              "version": "n/a"
            }
          ]
        }
      ]
    }
  ],
  "published": "2004-12-31T05:00:00.000",
  "references": [
    {
      "url": "http://echo.or.id/adv/adv07-y3dips-2004.txt",
      "tags": [
        "Exploit",
        "Vendor Advisory"
      ],
      "source": "cve@mitre.org"
    },
    {
      "url": "http://marc.info/?l=bugtraq&m=109664986210763&w=2",
      "source": "cve@mitre.org"
    },
    {
      "url": "http://securitytracker.com/id?1011484",
      "source": "cve@mitre.org"
    },
    {
      "url": "http://www.securityfocus.com/bid/11301",
      "source": "cve@mitre.org"
    },
    {
      "url": "https://exchange.xforce.ibmcloud.com/vulnerabilities/17571",
      "source": "cve@mitre.org"
    },
    {
      "url": "http://echo.or.id/adv/adv07-y3dips-2004.txt",
      "tags": [
        "Exploit",
        "Vendor Advisory"
      ],
      "source": "af854a3a-2127-422b-91ae-364da2661108"
    },
    {
      "url": "http://marc.info/?l=bugtraq&m=109664986210763&w=2",
      "source": "af854a3a-2127-422b-91ae-364da2661108"
    },
    {
      "url": "http://securitytracker.com/id?1011484",
      "source": "af854a3a-2127-422b-91ae-364da2661108"
    },
    {
      "url": "http://www.securityfocus.com/bid/11301",
      "source": "af854a3a-2127-422b-91ae-364da2661108"
    },
    {
      "url": "https://exchange.xforce.ibmcloud.com/vulnerabilities/17571",
      "source": "af854a3a-2127-422b-91ae-364da2661108"
    }
  ],
  "vulnStatus": "Modified",
  "weaknesses": [
    {
      "type": "Primary",
      "source": "nvd@nist.gov",
      "description": [
        {
          "lang": "en",
          "value": "NVD-CWE-Other"
        }
      ]
    }
  ],
  "descriptions": [
    {
      "lang": "en",
      "value": "The documentation for AJ-Fork 167 implies that users should set permissions for users.db.php to 777, which allows local users to execute arbitrary PHP code and gain privileges as the administrator."
    }
  ],
  "lastModified": "2026-06-16T22:07:58.350",
  "configurations": [
    {
      "nodes": [
        {
          "negate": false,
          "cpeMatch": [
            {
              "criteria": "cpe:2.3:a:aj-fork:aj-fork:167:*:*:*:*:*:*:*",
              "vulnerable": true,
              "matchCriteriaId": "FAB42474-4D4C-448B-9462-03ED772240EC"
            },
            {
              "criteria": "cpe:2.3:a:cutephp:cutenews:0.88:*:*:*:*:*:*:*",
              "vulnerable": true,
              "matchCriteriaId": "35BB2223-5238-4E3D-895A-BE6793AE3A9A"
            },
            {
              "criteria": "cpe:2.3:a:cutephp:cutenews:1.3:*:*:*:*:*:*:*",
              "vulnerable": true,
              "matchCriteriaId": "4254A63A-3202-4D06-90B3-12D10511BC2E"
            },
            {
              "criteria": "cpe:2.3:a:cutephp:cutenews:1.3.1:*:*:*:*:*:*:*",
              "vulnerable": true,
              "matchCriteriaId": "D9A2D600-BEA7-4936-B210-91629B2EFCDC"
            },
            {
              "criteria": "cpe:2.3:a:cutephp:cutenews:1.3.2:*:*:*:*:*:*:*",
              "vulnerable": true,
              "matchCriteriaId": "674CC558-E3B7-4120-879A-0408A595C5BC"
            },
            {
              "criteria": "cpe:2.3:a:cutephp:cutenews:1.3.6:*:*:*:*:*:*:*",
              "vulnerable": true,
              "matchCriteriaId": "EF7BF20D-34F9-453A-A54A-3A0B39EAAD58"
            }
          ],
          "operator": "OR"
        }
      ]
    }
  ],
  "sourceIdentifier": "cve@mitre.org"
}