CVE-2014-125138: C97net qEngine CMS through 6.0.0, Kemana Directory through 1.5.6, Cart Engine through 3.0.0 Unrestricted File Upload via Image Fields

Q: Who can exploit this vulnerability?

An authenticated user with the Editor role can exploit it. The attack does not require user interaction and can be performed remotely.

Q: What access or configuration is required for exploitation?

The affected administrative image-upload fields must be available to an Editor-role user. Exploitation uses the page_image or cat_image parameters to upload a PHP script into the web-accessible /public/image directory.

Q: What is the impact after a successful upload?

The attacker can request the uploaded PHP script from the web-accessible image directory and execute code on the server. This can affect confidentiality, integrity, and availability.

Q: Which product versions are affected?

Affected versions are qEngine CMS through 6.0.0, Kemana Directory through 1.5.6, and Cart Engine through 3.0.0.

Published Oct 28, 2026

Updated

C97net qEngine CMS through 6.0.0, Kemana Directory through 1.5.6, and Cart Engine through 3.0.0 contain an unrestricted file upload vulnerability in administrative image fields. Editor-role users can upload PHP scripts via the pageimage or catimage parameters to the web-accessible /public/image directory and request them to execute code on the server.

Affected Software

3 affected components

C97net qEngine CMS<=6.0.0

C97net Kemana Directory<=1.5.6

C97net Cart Engine<=3.0.0

Event History

Oct 28, 2026

CVE Published

via MITRE·02:03 AM

Data Sourced

via MITRE·02:03 AM

DescriptionSeverityWeakness

Frequently Asked Questions

Who can exploit this vulnerability?

An authenticated user with the Editor role can exploit it. The attack does not require user interaction and can be performed remotely.

What access or configuration is required for exploitation?

The affected administrative image-upload fields must be available to an Editor-role user. Exploitation uses the page_image or cat_image parameters to upload a PHP script into the web-accessible /public/image directory.

What is the impact after a successful upload?

The attacker can request the uploaded PHP script from the web-accessible image directory and execute code on the server. This can affect confidentiality, integrity, and availability.

Which product versions are affected?

Affected versions are qEngine CMS through 6.0.0, Kemana Directory through 1.5.6, and Cart Engine through 3.0.0.

CVE-2014-125138: C97net qEngine CMS through 6.0.0, Kemana Directory through 1.5.6, Cart Engine through 3.0.0 Unrestricted File Upload via Image Fields

Affected Software

Event History

Frequently Asked Questions

Who can exploit this vulnerability?

What access or configuration is required for exploitation?

What is the impact after a successful upload?

Which product versions are affected?

Company

Resources

Contact

Frequently Asked Questions

Who can exploit this vulnerability?

What access or configuration is required for exploitation?

What is the impact after a successful upload?

Which product versions are affected?