6.5Media
CVE-2014-125137C97net qEngine CMS through 6.0.0, Kemana Directory through 1.5.6, Cart Engine through 3.0.0 Local File Inclusion via admin/task.php
Descripción
C97net qEngine CMS through 6.0.0, Kemana Directory through 1.5.6, and Cart Engine through 3.0.0 contain a local file inclusion vulnerability in the run parameter of admin/task.php. Authenticated administrators can supply directory traversal sequences in the run parameter to include and disclose local files readable by the web server.
Debilidad (CWE):
CWE-98
Datos: CVE.org, NVD, CISA KEV, FIRST EPSS, Ubuntu. Se publican tal como los indican las fuentes, en inglés.
Productos y versiones afectados
| Fabricante | Producto | Versiones | |
|---|---|---|---|
| c97 | cart engine | ≤ 3.0.0 | |
| C97net | Cart Engine | ≤ 3.0.0 | |
| C97net | Kemana Directory | ≤ 1.5.6 | |
| C97net | qEngine CMS | ≤ 6.0.0 |
Referencias y parches
- Zero Science Lab Advisory ZSL-2014-5173: qEngine CMS 6.0.0 (task.php) Local File Inclusion Vulnerability third-party-advisory
- Zero Science Lab Advisory ZSL-2014-5177: Kemana Directory 1.5.6 (run param) Local File Inclusion Vulnerability third-party-advisory
- Zero Science Lab Advisory ZSL-2014-5181: Cart Engine 3.0.0 (task.php) Local File Inclusion Vulnerability third-party-advisory
- ExploitDB-32511: qEngine CMS 6.0.0 Multiple Vulnerabilities exploit
- ExploitDB-39129: qEngine 4.1.6/6.0.0 'task.php' Local File Inclusion exploit
- ExploitDB-32508: Kemana Directory 1.5.6 'task.php' Local File Inclusion exploit
- ExploitDB-32504: Cart Engine 3.0.0 'task.php' Local File Inclusion exploit
- VulnCheck Advisory: C97net qEngine CMS through 6.0.0, Kemana Directory through 1.5.6, Cart Engine through 3.0.0 Local File Inclusion via admin/task.php third-party-advisory