CVE-2004-1573: The documentation for AJ-Fork 167 implies that users should set permissions for users.db.php to 777, which...

Security readout for executives and security teams

CVE-2004-1573 concerns AJ-Fork 167 documentation telling users to make users.db.php world-writable. If followed, a local user on the same system could alter that PHP file and gain administrator-level control. This is mainly a configuration-exposure issue in very old software, not a broadly remote internet-facing flaw in the provided evidence. Exposure is likely limited to legacy AJ-Fork 167 installations where administrators followed the documented 777 permission guidance. Risk is higher on shared hosts or systems with untrusted local users. The provided affected-product metadata is incomplete. Treat this as a legacy hygiene issue with meaningful impact where AJ-Fork still exists. It does not justify emergency response without evidence of deployment, but any exposed instance should be corrected or retired because administrator compromise is possible from local access. Mitigation focus: Audit AJ-Fork installations for users.db.php permissions.; Remove world-writable permissions from users.db.php.; Restrict local shell or filesystem access to trusted users only..

Prepared

Jun 30, 2026, 00:25 UTC (UTC+00:00)

Generated from the cited source records. This long-tail analysis has not been individually reviewed by a named human.