QEngine CMS (<= 6.0.0) - CraftedSignal Threat Feedhttps://feed.craftedsignal.io/products/qengine-cms--6.0.0/Trending threats, MITRE ATT&CK coverage, and detection metadata. Fed continuously.Hugoenhello@craftedsignal.iohello@craftedsignal.ioWed, 28 Oct 2026 08:26:21 +0000https://feed.craftedsignal.io/favicon-32x32.pngCraftedSignal Threat Feedhttps://feed.craftedsignal.io/3232https://feed.craftedsignal.io/favicon.svgC97net qEngine CMS, Kemana Directory, and Cart Engine: Unrestricted File Upload Remote Code Execution (CVE-2014-125138)https://feed.craftedsignal.io/briefs/2026-10-c97net-qengine-cms-file-upload-cve-2014-125138/Wed, 28 Oct 2026 08:26:21 +0000hello@craftedsignal.iohttps://feed.craftedsignal.io/briefs/2026-10-c97net-qengine-cms-file-upload-cve-2014-125138/C97net qEngine CMS, Kemana Directory, and Cart Engine are vulnerable to an unrestricted file upload flaw allowing authenticated Editor-role users to achieve remote code execution.C97net qEngine CMS through version 6.0.0, Kemana Directory through 1.5.6, and Cart Engine through 3.0.0 contain an unrestricted file upload vulnerability in administrative image fields. Authentication with Editor-level privileges allows an attacker to upload arbitrary PHP scripts to the web-accessible /public/image directory. Once uploaded, these files can be requested and executed by the web server, leading to remote code execution.

Impact

Successful exploitation allows authenticated attackers with Editor-level access to execute arbitrary PHP code on the server, potentially leading to full system compromise or data exfiltration.

Recommendation

  • Restrict access to administrative image upload fields to trusted users.
  • Implement server-side validation to ensure that uploaded files strictly adhere to expected image file extensions and content types.
  • Configure the web server to disable script execution within the /public/image directory.
  • Monitor administrative activity logs for unusual file upload patterns or modifications to the /public/image directory.
]]>highadvisory