CVE-2014-125136
MediumCVSS 5.9Exploitation Probability (EPSS)
Low risk35th percentile - higher than 35% of all known CVEs
Summary
C97net qEngine CMS through 6.0.0, Kemana Directory through 1.5.6, and Cart Engine through 3.0.0 contain an information disclosure vulnerability that exposes database backups in the web-accessible /admin/backup directory. Unauthenticated attackers can list the directory or guess date-based names like 'Full Backup YYYYMMDD.sql' to download dumps containing user records and administrator password hashes.
Risk Assessment
Exposure of database backups can lead to leakage of personal data and takeover of administrative accounts through cracking of password hashes. This poses a serious risk to confidentiality and integrity of the system.
Recommendation
Block network access to the /admin/backup directory, move backups outside the web-accessible directory, and force a change of administrator passwords. Upgrading the software to a non-vulnerable version is recommended.
Other vulnerabilities in qEngine CMS / Kemana Directory / Cart Engine
See all- CVE-2014-125138High
qEngine CMS, Kemana Directory, and Cart Engine contain an unrestricted file upload vulnerability in administrative image fields. Editor-role users can upload PHP scripts via the page_image or cat_image parameters to the web-accessible /public/image directory and request them to execute code on the server.
- CVE-2014-125137Medium
C97net qEngine CMS through 6.0.0, Kemana Directory through 1.5.6, and Cart Engine through 3.0.0 contain a local file inclusion vulnerability in the run parameter of admin/task.php. Authenticated administrators can supply directory traversal sequences in the run parameter to include and disclose local files readable by the web server.
Original NVD description (English source)
C97net qEngine CMS through 6.0.0, Kemana Directory through 1.5.6, and Cart Engine through 3.0.0 contain an information disclosure vulnerability that exposes database backups in the web-accessible /admin/backup directory. Unauthenticated attackers can list the directory or guess date-based names like 'Full Backup YYYYMMDD.sql' to download dumps containing user records and administrator password hashes.
Vulnerability data from NVD (NIST) · CISA KEV · EPSS