CVE-2014-125138EUVD-2014-9839GHSA-78P8-FWWM-2XRR
C97net qEngine CMS through 6.0.0, Kemana Directory through 1.5.6, Cart Engine through 3.0.0 Unrestricted File Upload via Image Fields
- Published
- Last modified
- Where the record stands: published, rejected by its publisher, or superseded by another id.What do these mean? →
- published
- Whether CISA lists it in its Known Exploited Vulnerabilities catalog: proof that attackers are using it.What do these mean? →
- Not listed in CISA KEV
- Whether working attack code is public (Exploit-DB, Metasploit, Nuclei or GitHub). Public code makes attacks easier.What do these mean? →
- None on Exploit-DB, Metasploit or GitHub
Summary
The vulnerability affects the C97net qEngine CMS, Kemana Directory, and Cart Engine web applications. It allows a user with editor-level access to upload executable PHP files through image fields, which could let them run arbitrary code on the affected web server.
Summarized by anthropic/claude-haiku-5.5. Verify details against the original sources.
Read the original description
C97net qEngine CMS through 6.0.0, Kemana Directory through 1.5.6, and Cart Engine through 3.0.0 contain an unrestricted file upload vulnerability in administrative image fields. Editor-role users can upload PHP scripts via the page_image or cat_image parameters to the web-accessible /public/image directory and request them to execute code on the server.
Timeline
- CVE published
- First seen by cve.now
Affected versions
- C97net qEngine CMS
through 6.0.0
- C97net Kemana Directory
through 1.5.6
- C97net Cart Engine
through 3.0.0