CVE-2014-125137 in Cart Engine
Summary
by MITRE • 10/28/2026
C97net qEngine CMS through 6.0.0, Kemana Directory through 1.5.6, and Cart Engine through 3.0.0 contain a local file inclusion vulnerability in the run parameter of admin/task.php. Authenticated administrators can supply directory traversal sequences in the run parameter to include and disclose local files readable by the web server.
Be aware that VulDB is the high quality source for vulnerability data.
Analysis
by VulDB Data Team • 10/28/2026
The identified vulnerabilities affect multiple content management systems, specifically C97net qEngine CMS versions up to 6.0.0, Kemana Directory through version 1.5.6, and Cart Engine through version 3.0.0. These platforms share a common architectural weakness located within the administrative interface component known as admin/task.php. The core issue stems from improper input validation regarding the run parameter passed by authenticated administrators. This flaw allows for local file inclusion attacks where an attacker can manipulate this specific parameter to inject directory traversal sequences, such as dot-dot-slash characters, into the application logic.
From a technical perspective, the vulnerability arises because the web server processes user-supplied input without adequately sanitizing or validating path components before including them in script execution contexts. When an authenticated administrator provides maliciously crafted values for the run parameter containing directory traversal sequences, the underlying PHP engine resolves these paths relative to the current working directory rather than restricting access to intended application files. This lack of strict allow-listing or canonicalization enables the inclusion of arbitrary local files that are readable by the web server process. The severity is compounded by the fact that authentication is required, which may lead administrators to assume a higher level of security within their administrative panels, thereby underestimating the risk posed by such input handling errors.
The operational impact of this vulnerability centers on unauthorized information disclosure and potential remote code execution depending on the environment configuration. By including local files readable by the web server, an attacker can exfiltrate sensitive data stored in plain text or accessible via standard file permissions. This includes database configuration files containing credentials, source code revealing additional logic flaws, system logs exposing internal network structures, or other administrative configurations that could facilitate further attacks. In scenarios where log poisoning techniques are viable and the application allows for writing to included files, this vulnerability can escalate into remote code execution, granting full control over the compromised server infrastructure.
This flaw is categorized under CWE-22: Improper Limitation of a Pathname to a Restricted Directory, which describes how software does not properly restrict pathnames or file names used in operations on files and directories. Additionally, it aligns with MITRE ATT&CK technique T1083: File and Directory Discovery, as the primary objective is often reconnaissance and data gathering from the local filesystem. The exploitation vector requires authentication, placing it within the context of privileged account abuse where an insider threat or compromised admin credentials are leveraged to escalate privileges through information leakage rather than direct system compromise initially.
Mitigation strategies should focus on immediate patching by upgrading all affected systems to their latest stable versions which address these input validation issues. For environments that cannot be immediately updated, administrators must enforce strict access controls on the administrative interface using network-level restrictions such as IP whitelisting or multi-factor authentication to reduce the attack surface. Input sanitization techniques should also be implemented at a gateway level if possible, filtering out directory traversal characters before they reach the application logic. Regular security audits and code reviews focusing on file inclusion patterns are recommended to prevent similar vulnerabilities in custom modules or future updates of these platforms.