Skip to content
Threat Feed
Subscribe
high advisory

C97net qEngine CMS, Kemana Directory, and Cart Engine: Unrestricted File Upload Remote Code Execution (CVE-2014-125138)

C97net qEngine CMS, Kemana Directory, and Cart Engine are vulnerable to an unrestricted file upload flaw allowing authenticated Editor-role users to achieve remote code execution.

CVE search metadata

CVE search record: CVE-2014-125138. Severity: high. CVSS: 8.8. KEV: no. Product: qEngine CMS (<= 6.0.0), Kemana Directory (<= 1.5.6), Cart Engine (<= 3.0.0). Brief: C97net qEngine CMS, Kemana Directory, and Cart Engine: Unrestricted File Upload Remote Code Execution (CVE-2014-125138). Brief link: https://feed.craftedsignal.io/briefs/2026-10-c97net-qengine-cms-file-upload-cve-2014-125138/

Triage facts

Revision 1
Applicability
qEngine CMS (<= 6.0.0), Kemana Directory (<= 1.5.6) +1
Evidence
Unknown
Severity
High
Action
Elevated
Sources
1 public source
Freshness
Revision 1Oct 28, 08:26 UTC
Detection
1 rule
Vulnerabilities
1 CVE
Source quality
A5Likely

C97net qEngine CMS through version 6.0.0, Kemana Directory through 1.5.6, and Cart Engine through 3.0.0 contain an unrestricted file upload vulnerability in administrative image fields. Authentication with Editor-level privileges allows an attacker to upload arbitrary PHP scripts to the web-accessible /public/image directory. Once uploaded, these files can be requested and executed by the web server, leading to remote code execution.

Impact

Successful exploitation allows authenticated attackers with Editor-level access to execute arbitrary PHP code on the server, potentially leading to full system compromise or data exfiltration.

Recommendation

  • Restrict access to administrative image upload fields to trusted users.
  • Implement server-side validation to ensure that uploaded files strictly adhere to expected image file extensions and content types.
  • Configure the web server to disable script execution within the /public/image directory.
  • Monitor administrative activity logs for unusual file upload patterns or modifications to the /public/image directory.

Immediate actions

Review access logs for POST requests to CMS upload handlers containing .php extensions in parameters

SOC 24h

Threat Hunt

Search for files created in /public/image directory with .php extensions

T1505.004 high high confidence hunt now

Data: File system audit logs, Web server directory listing logs

Mitigations

Disable execute permissions for the /public/image directory in web server configuration

immediate IT Operations

CVE-2014-125138

Detection coverage 1

Detects CVE-2014-125138 Exploitation - PHP File Upload to /public/image

high

Detects web requests attempting to upload PHP files via image parameters to the vulnerable CMS components

sigma tactics: execution, initial_access techniques: T1505.004 sources: webserver

Detection queries are available on the platform. Get full rules →