CVE-2014-125136: C97net qEngine CMS through 6.0.0, Kemana Directory through 1.5.6, Cart Engine through 3.0.0 Database Backup Exposure via /admin/backup

Q: Who can access the exposed backups?

An unauthenticated remote attacker can access them if the /admin/backup directory is web-accessible. No account or user interaction is required.

Q: What information could a downloaded backup contain?

The database dumps may contain user records and administrator password hashes. This creates a confidentiality risk even though integrity and availability are not affected.

Q: How might an attacker locate a backup file?

An attacker may list the /admin/backup directory or guess date-based filenames such as "Full Backup YYYYMMDD.sql".

Q: Which product versions are identified as affected?

The affected versions are qEngine CMS through 6.0.0, Kemana Directory through 1.5.6, and Cart Engine through 3.0.0.

Published Oct 28, 2026

Updated

C97net qEngine CMS through 6.0.0, Kemana Directory through 1.5.6, and Cart Engine through 3.0.0 contain an information disclosure vulnerability that exposes database backups in the web-accessible /admin/backup directory. Unauthenticated attackers can list the directory or guess date-based names like 'Full Backup YYYYMMDD.sql' to download dumps containing user records and administrator password hashes.

Affected Software

3 affected components

C97net qEngine CMS<=6.0.0

C97net Kemana Directory<=1.5.6

C97net Cart Engine<=3.0.0

Event History

Oct 28, 2026

CVE Published

via MITRE·02:03 AM

Data Sourced

via MITRE·02:03 AM

DescriptionSeverityWeakness

Frequently Asked Questions

Who can access the exposed backups?

An unauthenticated remote attacker can access them if the /admin/backup directory is web-accessible. No account or user interaction is required.

What information could a downloaded backup contain?

The database dumps may contain user records and administrator password hashes. This creates a confidentiality risk even though integrity and availability are not affected.

How might an attacker locate a backup file?

An attacker may list the /admin/backup directory or guess date-based filenames such as "Full Backup YYYYMMDD.sql".

Which product versions are identified as affected?

The affected versions are qEngine CMS through 6.0.0, Kemana Directory through 1.5.6, and Cart Engine through 3.0.0.

CVE-2014-125136: C97net qEngine CMS through 6.0.0, Kemana Directory through 1.5.6, Cart Engine through 3.0.0 Database Backup Exposure via /admin/backup

Affected Software

Event History

Frequently Asked Questions

Who can access the exposed backups?

What information could a downloaded backup contain?

How might an attacker locate a backup file?

Which product versions are identified as affected?

Company

Resources

Contact

Frequently Asked Questions

Who can access the exposed backups?

What information could a downloaded backup contain?

How might an attacker locate a backup file?

Which product versions are identified as affected?