CVE-2014-125137— C97net qEngine CMS through 6.0.0, Kemana Directory through 1.5.6, Cart Engine through 3.0.0 Local File Inclusion via admin/task.php

Quick assessment

Affected

C97net qEngine CMS

Exploitation

No confirmed in-the-wild exploitation; assess based on exposure

Recommended action

Check the vendor advisory and references for a fixed version. If immediate upgrade is impossible, restrict exposure and increase monitoring.

C97net qEngine CMS（6.0.0 及以下版本）、Kemana Directory（1.5.6 及以下版本）以及 Cart Engine（3.0.0 及以下版本）在 admin/task.php 文件的 run 参数中存在本地文件包含漏洞。已认证的管理员可在 run 参数中提供目录遍历序列，从而包含并泄露 Web 服务器可读的本地文件。

CVSS 6.5 · Medium Updated Oct 28, 2026

Possible ATT&CK Techniques 2 AI

T1070 · Indicator Removal T1583.006 · Web Services

Get alerts for future matching vulnerabilities Log in to subscribe

Vulnerability Information

Have questions about the vulnerability? See if Shenlong's analysis helps!

View Shenlong Deep Dive ↗

Although we use advanced large model technology, its output may still contain inaccurate or outdated information.Shenlong tries to ensure data accuracy, but please verify and judge based on the actual situation.

Vulnerability Title

C97net qEngine CMS through 6.0.0, Kemana Directory through 1.5.6, Cart Engine through 3.0.0 Local File Inclusion via admin/task.php

Source: CVE Program / CVE List V5

Vulnerability Description

C97net qEngine CMS through 6.0.0, Kemana Directory through 1.5.6, and Cart Engine through 3.0.0 contain a local file inclusion vulnerability in the run parameter of admin/task.php. Authenticated administrators can supply directory traversal sequences in the run parameter to include and disclose local files readable by the web server.

Source: CVE Program / CVE List V5

CVSS Information

CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N

Source: CVE Program / CVE List V5

Vulnerability Type

PHP程序中Include/Require语句包含文件控制不恰当(PHP远程文件包含)

Source: CVE Program / CVE List V5

Affected Products

Vendor	Product	Affected Versions	CPE
C97net	qEngine CMS	0 ~ 6.0.0	-
C97net	Kemana Directory	0 ~ 1.5.6	-
C97net	Cart Engine	0 ~ 3.0.0	-

II. Public POCs for CVE-2014-125137

#	POC Description	Source Link	Shenlong Link

AI-Generated POC Premium

No public POC found.

III. Intelligence Information for CVE-2014-125137

请登录查看更多情报信息。

Other References for CVE-2014-125137 (8)

https://www.exploit-db.com/exploits/32511 exploit
https://www.exploit-db.com/exploits/32504 exploit
https://www.exploit-db.com/exploits/39129 exploit
https://www.exploit-db.com/exploits/32508 exploit
https://www.zeroscience.mk/advisories/ZSL-2014-5181.html third-party-advisory
https://www.zeroscience.mk/advisories/ZSL-2014-5173.html third-party-advisory
https://www.zeroscience.mk/advisories/ZSL-2014-5177.html third-party-advisory
https://www.vulncheck.com/advisories/c97net-qengine-cms-through-6.0.0-kemana-directory-through-1.5.6-cart-engine-through-3.0.0-local-file-inclusion-via-admin-task-php third-party-advisory

https://www.cve.org/CVERecord?id=CVE-2014-125137

Same Patch Batch · C97net · 2026-10-28 · 3 CVEs total

CVE-2014-125138	8.8 HIGH	C97net qEngine CMS through 6.0.0, Kemana Directory through 1.5.6, Cart Engine through 3.0.
CVE-2014-125136	5.9 MEDIUM	C97net qEngine CMS through 6.0.0, Kemana Directory through 1.5.6, Cart Engine through 3.0.

IV. Related Vulnerabilities

Same product: qEngine CMS

Same vendor: C97net

Same weakness: CWE-98