{"description":"Trending threats, MITRE ATT\u0026CK coverage, and detection metadata. Fed continuously.","favicon":"https://feed.craftedsignal.io/favicon-32x32.png","feed_url":"https://feed.craftedsignal.io/products/qengine-cms--6.0.0/feed.json","home_page_url":"https://feed.craftedsignal.io/","icon":"https://feed.craftedsignal.io/apple-touch-icon.png","items":[{"_cs_actors":[],"_cs_cpes":["cpe:2.3:a:c97net:qengine_cms:*:*:*:*:*:*:*:*","cpe:2.3:a:c97net:kemana_directory:*:*:*:*:*:*:*:*","cpe:2.3:a:c97net:cart_engine:*:*:*:*:*:*:*:*"],"_cs_cves":[{"cvss":8.8,"id":"CVE-2014-125138"}],"_cs_exploited":false,"_cs_has_poc":false,"_cs_poc_references":[],"_cs_products":["qEngine CMS (\u003c= 6.0.0)","Kemana Directory (\u003c= 1.5.6)","Cart Engine (\u003c= 3.0.0)"],"_cs_severities":["high"],"_cs_tags":[],"_cs_type":"advisory","_cs_vendors":["C97net"],"content_html":"\u003cp\u003eC97net qEngine CMS through version 6.0.0, Kemana Directory through 1.5.6, and Cart Engine through 3.0.0 contain an unrestricted file upload vulnerability in administrative image fields. Authentication with Editor-level privileges allows an attacker to upload arbitrary PHP scripts to the web-accessible /public/image directory. Once uploaded, these files can be requested and executed by the web server, leading to remote code execution.\u003c/p\u003e\n\u003ch2 id=\"impact\"\u003eImpact\u003c/h2\u003e\n\u003cp\u003eSuccessful exploitation allows authenticated attackers with Editor-level access to execute arbitrary PHP code on the server, potentially leading to full system compromise or data exfiltration.\u003c/p\u003e\n\u003ch2 id=\"recommendation\"\u003eRecommendation\u003c/h2\u003e\n\u003cul\u003e\n\u003cli\u003eRestrict access to administrative image upload fields to trusted users.\u003c/li\u003e\n\u003cli\u003eImplement server-side validation to ensure that uploaded files strictly adhere to expected image file extensions and content types.\u003c/li\u003e\n\u003cli\u003eConfigure the web server to disable script execution within the /public/image directory.\u003c/li\u003e\n\u003cli\u003eMonitor administrative activity logs for unusual file upload patterns or modifications to the /public/image directory.\u003c/li\u003e\n\u003c/ul\u003e\n","date_modified":"2026-10-28T08:26:21Z","date_published":"2026-10-28T08:26:21Z","id":"https://feed.craftedsignal.io/briefs/2026-10-c97net-qengine-cms-file-upload-cve-2014-125138/","summary":"C97net qEngine CMS, Kemana Directory, and Cart Engine are vulnerable to an unrestricted file upload flaw allowing authenticated Editor-role users to achieve remote code execution.","title":"C97net qEngine CMS, Kemana Directory, and Cart Engine: Unrestricted File Upload Remote Code Execution (CVE-2014-125138)","url":"https://feed.craftedsignal.io/briefs/2026-10-c97net-qengine-cms-file-upload-cve-2014-125138/"}],"language":"en","title":"CraftedSignal Threat Feed - QEngine CMS (\u003c= 6.0.0)","version":"https://jsonfeed.org/version/1.1"}