6.5Medium
CVE-2014-125137C97net qEngine CMS through 6.0.0, Kemana Directory through 1.5.6, Cart Engine through 3.0.0 Local File Inclusion via admin/task.php
Description
C97net qEngine CMS through 6.0.0, Kemana Directory through 1.5.6, and Cart Engine through 3.0.0 contain a local file inclusion vulnerability in the run parameter of admin/task.php. Authenticated administrators can supply directory traversal sequences in the run parameter to include and disclose local files readable by the web server.
Weakness (CWE):
CWE-98
Data: CVE.org, NVD, CISA KEV, FIRST EPSS, Ubuntu. Published as the sources state it, in English.
Affected products and versions
| Vendor | Product | Versions | |
|---|---|---|---|
| c97 | cart engine | ≤ 3.0.0 | |
| C97net | Cart Engine | ≤ 3.0.0 | |
| C97net | Kemana Directory | ≤ 1.5.6 | |
| C97net | qEngine CMS | ≤ 6.0.0 |
References and patches
- Zero Science Lab Advisory ZSL-2014-5173: qEngine CMS 6.0.0 (task.php) Local File Inclusion Vulnerability third-party-advisory
- Zero Science Lab Advisory ZSL-2014-5177: Kemana Directory 1.5.6 (run param) Local File Inclusion Vulnerability third-party-advisory
- Zero Science Lab Advisory ZSL-2014-5181: Cart Engine 3.0.0 (task.php) Local File Inclusion Vulnerability third-party-advisory
- ExploitDB-32511: qEngine CMS 6.0.0 Multiple Vulnerabilities exploit
- ExploitDB-39129: qEngine 4.1.6/6.0.0 'task.php' Local File Inclusion exploit
- ExploitDB-32508: Kemana Directory 1.5.6 'task.php' Local File Inclusion exploit
- ExploitDB-32504: Cart Engine 3.0.0 'task.php' Local File Inclusion exploit
- VulnCheck Advisory: C97net qEngine CMS through 6.0.0, Kemana Directory through 1.5.6, Cart Engine through 3.0.0 Local File Inclusion via admin/task.php third-party-advisory