CVE-2014-125136
C97net qEngine CMS through 6.0.0, Kemana Directory through 1.5.6, Cart Engine through 3.0.0 Database Backup Exposure via /admin/backup
C97net qEngine CMS
CVSS
8.2HighExploitationNo known exploitationNot in CISA KEV, which does not prove it is unexploitedCISA KEV
Exploit odds (EPSS)No scoreNo FIRST EPSS score in this snapshot yet
Fixed inNone listedNo source names a fixed version. Check the vendor advisory below
What fixes it
No source in this snapshot names a fixed version. The vendor advisories under References are the place to check.
Description
C97net qEngine CMS through 6.0.0, Kemana Directory through 1.5.6, and Cart Engine through 3.0.0 contain an information disclosure vulnerability that exposes database backups in the web-accessible /admin/backup directory. Unauthenticated attackers can list the directory or guess date-based names like 'Full Backup YYYYMMDD.sql' to download dumps containing user records and administrator password hashes.
Text from CVE List
Affected versions 3
- qEngine CMSaffected: all versions through 6.0.0CVE List
- Kemana Directoryaffected: all versions through 1.5.6CVE List
- Cart Engineaffected: all versions through 3.0.0CVE List
References 7
- zeroscience.mk/advisories/ZSL-2014-5172.htmlAdvisoryvia CVE List
- zeroscience.mk/advisories/ZSL-2014-5176.htmlAdvisoryvia CVE List
- zeroscience.mk/advisories/ZSL-2014-5180.htmlAdvisoryvia CVE List
- vulncheck.com/advisories/c97net-qengine-cms-through-6.0.0-kemana-directory-through-1.5.6-cart-engine-through-3.0.0-database-backup-exposure-via-admin-backupAdvisoryvia CVE List
- exploit-db.com/exploits/32511Exploitvia CVE List
- exploit-db.com/exploits/32509Exploitvia CVE List
- exploit-db.com/exploits/32505Exploitvia CVE List