medium5.9
CVE-2014-125136
C97net qEngine CMS through 6.0.0, Kemana Directory through 1.5.6, and Cart Engine through 3.0.0 contain an information disclosure vulnerability that exposes da…
Impact
C97net qEngine CMS through 6.0.0, Kemana Directory through 1.5.6, and Cart Engine through 3.0.0 contain an information disclosure vulnerability that exposes database backups in the web-accessible /admin/backup directory. Unauthenticated attackers can list the directory or guess date-based names like 'Full Backup YYYYMMDD.sql' to download dumps containing user records and administrator password hashes.
Affected products
| Product | Affected versions |
|---|---|
| C97net QEngine CMS | through 6.0.0 |
| Kemana Directory | through 1.5.6 |
| And Cart Engine | through 3.0.0 |
Versions were read from the advisory text. No structured product data has been published for this record yet.
Weakness classification
References
- NVD record
- CVE.org record
- https://www.exploit-db.com/exploits/32505
- https://www.exploit-db.com/exploits/32509
- https://www.exploit-db.com/exploits/32511
- https://www.vulncheck.com/advisories/c97net-qengine-cms-through-6.0.0-kemana-directory-through-1.5.6-cart-engine-through-3.0.0-database-backup-exposure-via-admin-backup
- https://www.zeroscience.mk/advisories/ZSL-2014-5172.html
- https://www.zeroscience.mk/advisories/ZSL-2014-5176.html
- https://www.zeroscience.mk/advisories/ZSL-2014-5180.html