C97net qEngine CMS, Kemana Directory, Cart Engine: Database backup exposure
Summary
Three C97net web applications store database backups in the web-accessible /admin/backup directory. Unauthenticated attackers can list the directory or guess predictable backup file names and download dumps containing user records and administrator password hashes. The flaw requires no login and no user interaction.
Affected
- qEngine CMS up to and including 6.0.0
- Kemana Directory up to and including 1.5.6
- Cart Engine up to and including 3.0.0
Fixed in
- qEngine CMS: version 7 (released 31 May 2014 according to the Zero Science Lab advisory; not verified against a vendor source)
- Kemana Directory: Unknown.
- Cart Engine: Unknown.
Workaround
- No vendor mitigation found.
- Remove backup files from the web root and store backups outside it.
- Disable directory listing and block web access to /admin/backup.
- Restrict /admin to internal IP addresses or VPN.
Exploitation
- Public proof of concept available (Exploit-DB 32505, 32509, 32511).
- VulDB states that no exploit is available; this conflicts with the public PoCs.
- No reports of active exploitation found; not listed in CISA KEV according to Strix.
Our recommendation
- Check your asset inventory for qEngine CMS, Kemana Directory and Cart Engine.
- If found on an internet-facing host, act immediately: remove exposed backup files and block /admin/backup.
- Check web server logs for requests to the backup path and downloads of backup files.
- If a backup was exposed, reset administrator passwords, review user accounts and check for password reuse.
- Plan migration to a supported platform if no fixed version exists for the product in use.
Public exploits
PoC-in-GitHub, Metasploit and Exploit-DB list nothing for this CVE.
Research sources
- VulnCheck advisory www.vulncheck.com
- Zero Science Lab ZSL-2014-5172 (qEngine CMS) www.zeroscience.mk
- Zero Science Lab ZSL-2014-5176 (Kemana Directory) www.zeroscience.mk
- Zero Science Lab ZSL-2014-5180 (Cart Engine) www.zeroscience.mk
- Exploit-DB 32505 (Cart Engine) www.exploit-db.com
- Exploit-DB 32509 (Kemana Directory) www.exploit-db.com
- Exploit-DB 32511 (qEngine CMS) www.exploit-db.com
- VulnCheck CVE record context (Vulners NVD) vulners.com
Researched and written up in English and German by an AI (Claude by Anthropic) based on NVD, CISA, EPSS and the sources listed. The vendor information is authoritative. Researched on 1 Nov 2026, 14:50.
Original description (NVD)
C97net qEngine CMS through 6.0.0, Kemana Directory through 1.5.6, and Cart Engine through 3.0.0 contain an information disclosure vulnerability that exposes database backups in the web-accessible /admin/backup directory. Unauthenticated attackers can list the directory or guess date-based names like 'Full Backup YYYYMMDD.sql' to download dumps containing user records and administrator password hashes.
NVD references (7)
- https://www.exploit-db.com/exploits/32505
- https://www.exploit-db.com/exploits/32509
- https://www.exploit-db.com/exploits/32511
- https://www.vulncheck.com/advisories/c97net-qengine-cms-through-6.0.0-kemana-directory-through-1.5.6-cart-eng…
- https://www.zeroscience.mk/advisories/ZSL-2014-5172.html
- https://www.zeroscience.mk/advisories/ZSL-2014-5176.html
- https://www.zeroscience.mk/advisories/ZSL-2014-5180.html
Sources
The tracker combines official, freely usable data sources – updated continuously:
- NVD (NIST) – CVEs, rating (CVSS), affected products
- CISA KEV – vulnerabilities confirmed by CISA as actively exploited
- CISA Vulnrichment – CISA assessment (SSVC) in the official CVE record
- FIRST EPSS – probability of exploitation
- Microsoft MSRC – Patch Tuesday: vulnerabilities, severity, updates
- PoC-in-GitHub – public proof-of-concept repositories
- Metasploit (Rapid7) – modules of the Metasploit Framework
- Exploit-DB (OffSec) – archive of public exploits (links only)
- Patch days: official vendor pages (linked per vendor) (Vendor patch days)
This product uses data from the NVD API but is not endorsed or certified by the NVD. EPSS data © FIRST.org.
Affected? We can help.
We check whether your systems are affected, install updates and close the gap – continuously with the System Health Checker if you wish.