CVE-2014-125138— C97net qEngine CMS through 6.0.0, Kemana Directory through 1.5.6, Cart Engine through 3.0.0 Unrestricted File Upload via Image Fields

Quick assessment

Affected

C97net qEngine CMS

Exploitation

No confirmed in-the-wild exploitation; assess based on exposure

Recommended action

Check the vendor advisory and references for a fixed version. If immediate upgrade is impossible, restrict exposure and increase monitoring.

C97net qEngine CMS（6.0.0 及更早版本）、Kemana Directory（1.5.6 及更早版本）以及 Cart Engine（3.0.0 及更早版本）在管理后台的图片字段中存在不受限制的文件上传漏洞。拥有编辑者（Editor）角色的用户可通过或参数，将 PHP 脚本上传至可通过 Web 访问的目录，并请求服务器执行这些脚本，从而实现远程代码执行。

CVSS 8.8 · High Updated Oct 28, 2026

Possible ATT&CK Techniques 3 AI

T1190 · Exploit Public-Facing Application T1059 · Command and Scripting Interpreter T1105 · Ingress Tool Transfer

Get alerts for future matching vulnerabilities Log in to subscribe

Vulnerability Information

Have questions about the vulnerability? See if Shenlong's analysis helps!

View Shenlong Deep Dive ↗

Although we use advanced large model technology, its output may still contain inaccurate or outdated information.Shenlong tries to ensure data accuracy, but please verify and judge based on the actual situation.

Vulnerability Title

C97net qEngine CMS through 6.0.0, Kemana Directory through 1.5.6, Cart Engine through 3.0.0 Unrestricted File Upload via Image Fields

Source: CVE Program / CVE List V5

Vulnerability Description

C97net qEngine CMS through 6.0.0, Kemana Directory through 1.5.6, and Cart Engine through 3.0.0 contain an unrestricted file upload vulnerability in administrative image fields. Editor-role users can upload PHP scripts via the page_image or cat_image parameters to the web-accessible /public/image directory and request them to execute code on the server.

Source: CVE Program / CVE List V5

CVSS Information

CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H

Source: CVE Program / CVE List V5

Vulnerability Type

危险类型文件的不加限制上传

Source: CVE Program / CVE List V5

Affected Products

Vendor	Product	Affected Versions	CPE
C97net	qEngine CMS	0 ~ 6.0.0	-
C97net	Kemana Directory	0 ~ 1.5.6	-
C97net	Cart Engine	0 ~ 3.0.0	-

II. Public POCs for CVE-2014-125138

#	POC Description	Source Link	Shenlong Link

AI-Generated POC Premium

No public POC found.

III. Intelligence Information for CVE-2014-125138

请登录查看更多情报信息。

Other References for CVE-2014-125138 (7)

https://www.exploit-db.com/exploits/32503 exploit
https://www.exploit-db.com/exploits/32511 exploit
https://www.exploit-db.com/exploits/32507 exploit
https://www.zeroscience.mk/advisories/ZSL-2014-5182.html third-party-advisory
https://www.zeroscience.mk/advisories/ZSL-2014-5174.html third-party-advisory
https://www.zeroscience.mk/advisories/ZSL-2014-5178.html third-party-advisory
https://www.vulncheck.com/advisories/c97net-qengine-cms-through-6.0.0-kemana-directory-through-1.5.6-cart-engine-through-3.0.0-unrestricted-file-upload-via-image-fields third-party-advisory

https://www.cve.org/CVERecord?id=CVE-2014-125138

Same Patch Batch · C97net · 2026-10-28 · 3 CVEs total

CVE-2014-125137	6.5 MEDIUM	C97net qEngine CMS through 6.0.0, Kemana Directory through 1.5.6, Cart Engine through 3.0.
CVE-2014-125136	5.9 MEDIUM	C97net qEngine CMS through 6.0.0, Kemana Directory through 1.5.6, Cart Engine through 3.0.

IV. Related Vulnerabilities

Same product: qEngine CMS

Same vendor: C97net

Same weakness: CWE-434