Live › vulnerability › CVE-2014-125137
Go to dashboardThree PHP products from C97net, qEngine CMS through 6.0.0, Kemana Directory through 1.5.6 and Cart Engine through 3.0.0, have a local file inclusion flaw in the run parameter of admin/task.php. An authenticated administrator can use directory traversal sequences there to include and read any file the web server can read.
Summary written from the sources below. Check the originals before acting.
First seen by InfraStack 2026-10-28 03:31 UTC. All times on this page are UTC.
Sites running qEngine CMS up to 6.0.0, Kemana Directory up to 1.5.6 or Cart Engine up to 3.0.0 are exposed. The attacker must already hold an administrator account on the application, so sites with no such accounts exposed to untrusted users carry less risk. The sources do not name a fixed version.
| Product | Ecosystem | Affected | Fixed in |
|---|---|---|---|
| qEngine CMS | vendor | <= 6.0.0 | – |
| Kemana Directory | vendor | <= 1.5.6 | – |
| Cart Engine | vendor | <= 3.0.0 | – |
6.0.0), Kemana Directory (<=1.5.6) or Cart Engine (<=3.0.0)unknown: no patched release found from C97net; restrict /admin/task.php (IP allowlist, web server auth) or retire the product
Each row is the first time that source carried this signal. The analyst’s rows are its own findings.
C97net qEngine CMS through 6.0.0, Kemana Directory through 1.5.6, and Cart Engine through 3.0.0 contain a local file inclusion vulnerability in the run parameter of admin/task.php. Authenticated administrators can supply directory traversal sequences in the run parameter to include and disclose local files readable by the web server.
This page as .md · .json · in your agent: get_signal("CVE-2014-125137")
NVD data is provided by NIST and is public domain. Posts quoted belong to their authors.