high8.8
CVE-2014-125138
C97net qEngine CMS through 6.0.0, Kemana Directory through 1.5.6, and Cart Engine through 3.0.0 contain an unrestricted file upload vulnerability in administra…
Impact
C97net qEngine CMS through 6.0.0, Kemana Directory through 1.5.6, and Cart Engine through 3.0.0 contain an unrestricted file upload vulnerability in administrative image fields. Editor-role users can upload PHP scripts via the page_image or cat_image parameters to the web-accessible /public/image directory and request them to execute code on the server.
Affected products
| Product | Affected versions |
|---|---|
| C97net QEngine CMS | through 6.0.0 |
| Kemana Directory | through 1.5.6 |
| And Cart Engine | through 3.0.0 |
Versions were read from the advisory text. No structured product data has been published for this record yet.
Weakness classification
References
- NVD record
- CVE.org record
- https://www.exploit-db.com/exploits/32503
- https://www.exploit-db.com/exploits/32507
- https://www.exploit-db.com/exploits/32511
- https://www.vulncheck.com/advisories/c97net-qengine-cms-through-6.0.0-kemana-directory-through-1.5.6-cart-engine-through-3.0.0-unrestricted-file-upload-via-image-fields
- https://www.zeroscience.mk/advisories/ZSL-2014-5174.html
- https://www.zeroscience.mk/advisories/ZSL-2014-5178.html
- https://www.zeroscience.mk/advisories/ZSL-2014-5182.html