{"id":"CVE-2014-125136","kind":"vulnerability","aliases":["CVE-2014-125136"],"related":[],"title":"C97net qEngine, Kemana Directory, Cart Engine: exposed database backups leak admin hashes","description":"C97net qEngine CMS through 6.0.0, Kemana Directory through 1.5.6, and Cart Engine through 3.0.0 contain an information disclosure vulnerability that exposes database backups in the web-accessible /admin/backup directory. Unauthenticated attackers can list the directory or guess date-based names like 'Full Backup YYYYMMDD.sql' to download dumps containing user records and administrator password hashes.","summary":"Three PHP shopping and CMS products (qEngine CMS through 6.0.0, Kemana Directory through 1.5.6, Cart Engine through 3.0.0) leave database backups in a web-accessible /admin/backup directory. An unauthenticated attacker can list the directory or guess date-based filenames and download dumps containing user records and administrator password hashes.","severity":"high","cvss":8.2,"epss":null,"exploited":false,"exploited_at":null,"products":[],"ecosystems":[],"tags":["cart-engine","kemana-directory","other","php","qengine","self-hosted"],"not_affected_if":["backups-outside-web-root","path-denied-by-server"],"how_to_check":"- Request `/admin/backup/` on the site and see whether the directory listing or any `.sql` file is served\n- Look for files named like `Full Backup YYYYMMDD.sql` in the web root or the admin backup folder\n- Confirm the installed version of qEngine CMS, Kemana Directory or Cart Engine is above the listed versions","fix":"- No fixed version is named in the sources: unknown\n- Remove the backup files from the web-accessible directory and block `/admin/backup` at the web server\n- Move backups outside the web root and rotate administrator and user passwords since hashes may be exposed","status":"open","published_at":"2026-10-28T03:17:07+00:00","first_seen_at":"2026-10-28T03:31:01+00:00","triaged_at":"2026-10-28T03:32:31+00:00","updated_at":"2026-10-28T03:32:31+00:00","category":"other","confidence":0.6,"triage":{"at":"2026-10-28T03:32:31Z","model":"claude-haiku-5-5","output":{"fix":"- No fixed version is named in the sources: unknown\n- Remove the backup files from the web-accessible directory and block `/admin/backup` at the web server\n- Move backups outside the web root and rotate administrator and user passwords since hashes may be exposed","reach":"internet","title":"C97net qEngine, Kemana Directory, Cart Engine: exposed database backups leak admin hashes","impact":"high","summary":"Three PHP shopping and CMS products (qEngine CMS through 6.0.0, Kemana Directory through 1.5.6, Cart Engine through 3.0.0) leave database backups in a web-accessible /admin/backup directory. An unauthenticated attacker can list the directory or guess date-based filenames and download dumps containing user records and administrator password hashes.","category":"other","nicknames":[],"who_cares":["php","self-hosted","qengine","kemana-directory","cart-engine"],"confidence":0.6,"needs_auth":"no","worst_case":"Attacker downloads full database dump including admin password hashes","analyst_note":"Check the NVD entry and vendor pages for fixed versions and confirm whether the backup path is default.","how_to_check":"- Request `/admin/backup/` on the site and see whether the directory listing or any `.sql` file is served\n- Look for files named like `Full Backup YYYYMMDD.sql` in the web root or the admin backup folder\n- Confirm the installed version of qEngine CMS, Kemana Directory or Cart Engine is above the listed versions","needs_analyst":true,"not_affected_if":["backups-outside-web-root","path-denied-by-server"],"who_is_affected":"Sites running C97net qEngine CMS up to 6.0.0, Kemana Directory up to 1.5.6, or Cart Engine up to 3.0.0 where the backup directory sits under the public web root. Installations that keep backups outside the web root or deny that path are not exposed by this issue.","user_interaction":"no","needs_special_setup":"unknown","severity_if_unknown":"high"},"cost_usd":0.000688,"input_tokens":3375,"output_tokens":701,"severity_before":"high"},"analyst_status":null,"analyst_note":null,"search":"'-125136':15A,18A '-2014':14A,17A '/admin/backup':57B,110C '1.5.6':44B,90C '3.0.0':48B,95C '6.0.0':40B,86C 'access':56B,109C 'admin':11A 'administr':79B,135C 'attack':61B,113C 'backup':9A,51B,104C,126C 'base':70B,122C 'c97net':1A,82C 'cart':5A,20B,45B,92C 'cart-engin':19B 'cms':35B,38B,84C 'contain':75B,96C,131C 'cve':13A,16A 'databas':8A,50B,103C 'date':69B,121C 'date-bas':68B,120C 'directori':4A,24B,42B,58B,65B,88C,111C,117C 'disclosur':99C 'download':73B,129C 'dump':74B,130C 'engin':6A,21B,46B,93C 'expos':7A,102C 'filenam':71B 'full':125C 'guess':67B,119C 'hash':12A,81B,137C 'host':30B 'inform':98C 'kemana':3A,23B,41B,87C 'kemana-directori':22B 'leak':10A 'leav':49B 'like':124C 'list':63B,115C 'name':123C 'password':80B,136C 'php':26B,32B 'product':36B 'qengin':2A,27B,37B,83C 'record':77B,133C 'self':29B 'self-host':28B 'shop':33B 'three':31B 'unauthent':60B,112C 'user':76B,132C 'vulner':100C 'web':55B,108C 'web-access':54B,107C 'yyyymmdd.sql':127C","nicknames":[],"mitigations":[],"who_affected":"Sites running C97net qEngine CMS up to 6.0.0, Kemana Directory up to 1.5.6, or Cart Engine up to 3.0.0 where the backup directory sits under the public web root. Installations that keep backups outside the web root or deny that path are not exposed by this issue.","tier":"B","verified":{},"analyst_revisit_at":null,"first_public_at":"2026-10-28T03:17:07+00:00","kev":null,"cvss_vector":"CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:H/VI:N/VA:N/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","cvss_by":"disclosure@vulncheck.com","poc_count":0,"sources":[{"source":"nvd","external_id":"CVE-2014-125136","url":"https://nvd.nist.gov/vuln/detail/CVE-2014-125136","severity":null,"published_at":"2026-10-28T03:17:07+00:00","modified_at":"2026-10-28T03:17:07+00:00","first_seen_at":"2026-10-28T03:31:01+00:00","fetched_at":"2026-10-28T03:31:01+00:00","note":null}],"documents":[],"notice":"Free to read at a human pace. An API with keys and an MCP server are in preparation; early access: hello@infrastack.ai"}