C97net qEngine CMS, Kemana Directory, Cart Engine: Unrestricted file upload

Summary

Three C97net content management systems allow a user with the Editor role to upload PHP scripts through administrative image fields (page_image or cat_image). The uploaded files are stored in the web-accessible /public/image directory and can be requested to run code on the server. Exploitation requires a valid Editor account; public exploit references exist.

Affected

• qEngine CMS through 6.0.0
• Kemana Directory through 1.5.6
• Cart Engine through 3.0.0

Fixed in

Unknown. No vendor advisory or fixed release for Kemana Directory or Cart Engine was found. The vendor released qEngine 7 on 31 May 2014 according to a third-party advisory, which was not verified against the vendor site.

Workaround

• Block script execution in /public/image
• Audit /public/image for PHP or other script files
• Remove or reduce Editor-role accounts
• Restrict admin access by IP address or VPN
• Apply strict file upload restrictions at web server or application level (according to VulDB; not verified)

Exploitation

• Public exploit references exist (Exploit-DB 32503, 32507, 32511)
• Authentication as Editor is required (PR:L)
• No known in-the-wild exploitation found; not listed in CISA KEV according to a third-party tracker, not verified against the catalogue
• Related CVE-2014-125136 reportedly exposes database backups that may contain administrator password hashes

Our recommendation

• Check whether any client runs qEngine CMS, Kemana Directory or Cart Engine and confirm the version
• Check /public/image for unexpected PHP files and remove them
• Block script execution in the image directory
• Restrict Editor accounts and admin access, enforce strong passwords and MFA where possible
• Plan a migration to a supported CMS if no fixed version exists
• Assess related CVE-2014-125136 and CVE-2014-125137 at the same time
• Monitor web server logs for requests to /public/image

Public exploits iAttack code is publicly available (PoC on GitHub, Metasploit or Exploit-DB).

PoC-in-GitHub, Metasploit and Exploit-DB list nothing for this CVE.

Research sources

• VulnCheck advisory www.vulncheck.com
• Zero Science Lab ZSL-2014-5174 (qEngine CMS) www.zeroscience.mk
• Zero Science Lab ZSL-2014-5178 (Kemana Directory) www.zeroscience.mk
• Zero Science Lab ZSL-2014-5182 (Cart Engine) www.zeroscience.mk
• Exploit-DB 32511 (qEngine CMS) www.exploit-db.com
• Exploit-DB 32507 (Kemana Directory) www.exploit-db.com
• Exploit-DB 32503 (Cart Engine) www.exploit-db.com
• VulDB CVE-2014-125138 vuldb.com

Researched and written up in English and German by an AI (Claude by Anthropic) based on NVD, CISA, EPSS and the sources listed. The vendor information is authoritative. Researched on 31 Oct 2026, 23:50.