---
id: "CVE-2014-125137"
kind: "vulnerability"
aliases: ["CVE-2014-125137"]
title: "qEngine, Kemana Directory and Cart Engine: admin file inclusion reads server files"
severity: "high"
cvss: 7.1
epss: null
exploited: false
status: "open"
category: "other"
products: [{"name": "qEngine CMS", "fixed": [], "affected": "<= 6.0.0", "ecosystem": "vendor"}, {"name": "Kemana Directory", "fixed": [], "affected": "<= 1.5.6", "ecosystem": "vendor"}, {"name": "Cart Engine", "fixed": [], "affected": "<= 3.0.0", "ecosystem": "vendor"}]
ecosystems: []
tags: ["cart-engine", "cms", "kemana", "lfi", "other", "php", "qengine", "self-hosted"]
not_affected_if: ["auth-required", "managed-hosting", "not-installed"]
published_at: "2026-10-28T03:17:07+00:00"
first_seen_at: "2026-10-28T03:31:01+00:00"
updated_at: "2026-10-28T03:33:13+00:00"
sources: [{"source": "nvd", "url": "https://nvd.nist.gov/vuln/detail/CVE-2014-125137", "first_seen_at": "2026-10-28T03:31:01+00:00"}, {"source": "analyst", "url": null, "first_seen_at": "2026-10-28T03:33:13+00:00"}]
---

# qEngine, Kemana Directory and Cart Engine: admin file inclusion reads server files

Three PHP products from C97net, qEngine CMS through 6.0.0, Kemana Directory through 1.5.6 and Cart Engine through 3.0.0, have a local file inclusion flaw in the run parameter of admin/task.php. An authenticated administrator can use directory traversal sequences there to include and read any file the web server can read.

_Summary, check and fix written by a model from the sources; labelled as such._

## Affected

- vendor:qEngine CMS affected <= 6.0.0 fixed ?
- vendor:Kemana Directory affected <= 1.5.6 fixed ?
- vendor:Cart Engine affected <= 3.0.0 fixed ?

## How to check

Look for task.php in the admin directory of qEngine CMS (<=6.0.0), Kemana Directory (<=1.5.6) or Cart Engine (<=3.0.0). Any install of these versions is affected; no fixed version is known.

## Fix

unknown: no patched release found from C97net; restrict /admin/task.php (IP allowlist, web server auth) or retire the product

## Timeline

- 2026-10-28T03:31:01+00:00 nvd https://nvd.nist.gov/vuln/detail/CVE-2014-125137
- 2026-10-28T03:33:13+00:00 analyst — Researcher advisories (Zero Science ZSL-2014-5173/5181, ExploitDB 32508, Mar 2014) confirm authenticated LFI via 'run' param of task.php. Vendor never published a fix (promised April 2014 patch; none found), so fix unknown. Nothing verified: no vendor page read. Public PoC exists, no exploitation reports.

## Documents

- [advisory] Cart Engine 3.0.0 (task.php) LFI - Zero Science Lab ZSL-2014-5181 https://www.zeroscience.mk/advisories/ZSL-2014-5181.html
- [advisory] qEngine CMS 6.0.0 task.php LFI (ZSL-2014-5173) https://cxsecurity.com/issue/WLB-2014030189
- [poc] Kemana Directory 1.5.6 task.php LFI (ExploitDB 32508) https://www.exploit-db.com/exploits/32508

## From the sources

C97net qEngine CMS through 6.0.0, Kemana Directory through 1.5.6, and Cart Engine through 3.0.0 contain a local file inclusion vulnerability in the run parameter of admin/task.php. Authenticated administrators can supply directory traversal sequences in the run parameter to include and disclose local files readable by the web server.

---

_Free to read at a human pace. An API with keys and an MCP server are in preparation; early access: hello@infrastack.ai_