CVE-2014-125137 Details
Description
C97net qEngine CMS through 6.0.0, Kemana Directory through 1.5.6, and Cart Engine through 3.0.0 contain a local file inclusion vulnerability in the run parameter of admin/task.php. Authenticated administrators can supply directory traversal sequences in the run parameter to include and disclose local files readable by the web server.
A local file inclusion vulnerability has been identified in C97net qEngine CMS versions through 6.0.0, Kemana Directory versions through 1.5.6, and Cart Engine versions through 3.0.0. The vulnerability exists in the run parameter of admin/task.php, where authenticated administrators can exploit improper input validation to include and disclose local files that are readable by the web server. This is achieved by using directory traversal sequences in the run parameter.
Users are advised to update to qEngine CMS version 7.0.0, which addresses this vulnerability. For Cart Engine and Kemana Directory, no specific update is mentioned, but users should check for any available patches or updates from the vendor.
Metrics
CVSS 4.0 Severity and Vector Strings:
VolerionCVSS 3.x Severity and Vector Strings:
No data available for CVSS Version 2.0 on this CVE.
Volerion
Assessed Oct 28, 2026CISA-ADP
Assessed Nov 5, 2026References to Advisories, Solutions, and Tools
By selecting these links, you will be leaving this site. These are references gathered from the official CVE record and are not endorsed by Volerion.
Weakness Enumeration
| CWE-ID | CWE Name | Source |
|---|---|---|
| CWE-98 | Improper Control of Filename for Include/Require Statement in PHP Program ('PHP Remote File Inclusion') | [email protected] |
Affected Products
| Product | Versions |
|---|---|
| C97net qEngine CMS | <= 6.0.0 (semver) |
CPE
Remediation
| |
| C97net Kemana Directory | <= 1.5.6 (semver) |
CPE
Remediation
| |
| C97net Cart Engine | <= 3.0.0 (semver) |
CPE
Remediation
| |
Change History
2 change records found show changes
| Date | Action | Recorded By |
|---|---|---|
| Nov 5, 2026 | CVE Modified | CISA-ADP |
| Oct 28, 2026 | New CVE Received | [email protected] |