CVE-2014-125138
C97net qEngine CMS through 6.0.0, Kemana Directory through 1.5.6, Cart Engine through 3.0.0 Unrestricted File Upload via Image Fields
C97net qEngine CMS
CVSS
8.7HighExploitationNo known exploitationNot in CISA KEV, which does not prove it is unexploitedCISA KEV
Exploit odds (EPSS)No scoreNo FIRST EPSS score in this snapshot yet
Fixed inNone listedNo source names a fixed version. Check the vendor advisory below
What fixes it
No source in this snapshot names a fixed version. The vendor advisories under References are the place to check.
Description
C97net qEngine CMS through 6.0.0, Kemana Directory through 1.5.6, and Cart Engine through 3.0.0 contain an unrestricted file upload vulnerability in administrative image fields. Editor-role users can upload PHP scripts via the page_image or cat_image parameters to the web-accessible /public/image directory and request them to execute code on the server.
Text from CVE List
Affected versions 3
- qEngine CMSaffected: all versions through 6.0.0CVE List
- Kemana Directoryaffected: all versions through 1.5.6CVE List
- Cart Engineaffected: all versions through 3.0.0CVE List
References 7
- zeroscience.mk/advisories/ZSL-2014-5174.htmlAdvisoryvia CVE List
- zeroscience.mk/advisories/ZSL-2014-5178.htmlAdvisoryvia CVE List
- zeroscience.mk/advisories/ZSL-2014-5182.htmlAdvisoryvia CVE List
- vulncheck.com/advisories/c97net-qengine-cms-through-6.0.0-kemana-directory-through-1.5.6-cart-engine-through-3.0.0-unrestricted-file-upload-via-image-fieldsAdvisoryvia CVE List
- exploit-db.com/exploits/32511Exploitvia CVE List
- exploit-db.com/exploits/32507Exploitvia CVE List
- exploit-db.com/exploits/32503Exploitvia CVE List