CVE-2014-125136— C97net qEngine CMS through 6.0.0, Kemana Directory through 1.5.6, Cart Engine through 3.0.0 Database Backup Exposure via /admin/backup

Quick assessment

Affected

C97net qEngine CMS

Exploitation

No confirmed in-the-wild exploitation; assess based on exposure

Recommended action

Check the vendor advisory and references for a fixed version. If immediate upgrade is impossible, restrict exposure and increase monitoring.

C97net qEngine CMS（6.0.0 及以下版本）、Kemana Directory（1.5.6 及以下版本）以及 Cart Engine（3.0.0 及以下版本）均存在信息泄露漏洞。该漏洞导致数据库备份文件暴露于可通过 Web 访问的目录中。未经认证的攻击者可以列出该目录内容，或通过猜测基于日期的文件名（例如"Full Backup YYYYMMDD.sql"）来下载包含用户记录和管理员密码哈希的数据库转储文件。

CVSS 5.9 · Medium Updated Oct 28, 2026

Possible ATT&CK Techniques 2 AI

T1020 · Automated Exfiltration T1190 · Exploit Public-Facing Application

Get alerts for future matching vulnerabilities Log in to subscribe

Vulnerability Information

Have questions about the vulnerability? See if Shenlong's analysis helps!

View Shenlong Deep Dive ↗

Although we use advanced large model technology, its output may still contain inaccurate or outdated information.Shenlong tries to ensure data accuracy, but please verify and judge based on the actual situation.

Vulnerability Title

C97net qEngine CMS through 6.0.0, Kemana Directory through 1.5.6, Cart Engine through 3.0.0 Database Backup Exposure via /admin/backup

Source: CVE Program / CVE List V5

Vulnerability Description

C97net qEngine CMS through 6.0.0, Kemana Directory through 1.5.6, and Cart Engine through 3.0.0 contain an information disclosure vulnerability that exposes database backups in the web-accessible /admin/backup directory. Unauthenticated attackers can list the directory or guess date-based names like 'Full Backup YYYYMMDD.sql' to download dumps containing user records and administrator password hashes.

Source: CVE Program / CVE List V5

CVSS Information

CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:N/A:N

Source: CVE Program / CVE List V5

Vulnerability Type

将备份文件暴露给非授权控制范围

Source: CVE Program / CVE List V5

Affected Products

Vendor	Product	Affected Versions	CPE
C97net	qEngine CMS	0 ~ 6.0.0	-
C97net	Kemana Directory	0 ~ 1.5.6	-
C97net	Cart Engine	0 ~ 3.0.0	-

II. Public POCs for CVE-2014-125136

#	POC Description	Source Link	Shenlong Link

AI-Generated POC Premium

No public POC found.

III. Intelligence Information for CVE-2014-125136

请登录查看更多情报信息。

Other References for CVE-2014-125136 (7)

https://www.exploit-db.com/exploits/32511 exploit
https://www.exploit-db.com/exploits/32505 exploit
https://www.exploit-db.com/exploits/32509 exploit
https://www.zeroscience.mk/advisories/ZSL-2014-5180.html third-party-advisory
https://www.zeroscience.mk/advisories/ZSL-2014-5172.html third-party-advisory
https://www.zeroscience.mk/advisories/ZSL-2014-5176.html third-party-advisory
https://www.vulncheck.com/advisories/c97net-qengine-cms-through-6.0.0-kemana-directory-through-1.5.6-cart-engine-through-3.0.0-database-backup-exposure-via-admin-backup third-party-advisory

https://www.cve.org/CVERecord?id=CVE-2014-125136

Same Patch Batch · C97net · 2026-10-28 · 3 CVEs total

CVE-2014-125138	8.8 HIGH	C97net qEngine CMS through 6.0.0, Kemana Directory through 1.5.6, Cart Engine through 3.0.
CVE-2014-125137	6.5 MEDIUM	C97net qEngine CMS through 6.0.0, Kemana Directory through 1.5.6, Cart Engine through 3.0.

IV. Related Vulnerabilities

Same product: qEngine CMS

Same vendor: C97net

Same weakness: CWE-530