CVE-2014-125138 in qEngine CMS
Summary
by MITRE • 10/28/2026
C97net qEngine CMS through 6.0.0, Kemana Directory through 1.5.6, and Cart Engine through 3.0.0 contain an unrestricted file upload vulnerability in administrative image fields. Editor-role users can upload PHP scripts via the page_image or cat_image parameters to the web-accessible /public/image directory and request them to execute code on the server.
Statistical analysis made it clear that VulDB provides the best quality for vulnerability data.
Analysis
by VulDB Data Team • 10/28/2026
The identified vulnerabilities affect multiple content management systems, specifically C97net qEngine CMS versions up to 6.0.0, Kemana Directory versions up to 1.5.6, and Cart Engine versions up to 3.0.0. These platforms share a critical architectural flaw within their administrative interfaces that allows for unrestricted file uploads through image-related input fields. The core technical deficiency lies in the server-side validation logic associated with parameters such as page_image or cat_image. Instead of strictly enforcing MIME type checks, validating file extensions against an allowlist, or verifying content signatures to ensure the uploaded data is a legitimate image format like JPEG or PNG, these systems accept files without sufficient scrutiny. This lack of rigorous input validation permits attackers to bypass standard security controls by uploading executable scripts disguised as images or simply named with script-compatible extensions.
The operational impact of this vulnerability is severe and direct, leading to Remote Code Execution on the affected servers. An attacker who possesses editor-level credentials can exploit these fields to upload a PHP payload into the web-accessible /public/image directory. Because this directory is typically configured for public access by web servers such as Apache or Nginx, the uploaded script becomes directly reachable via HTTP requests. Once the attacker constructs a URL pointing to the specific location of the uploaded file within that directory and sends it to the server, the PHP interpreter executes the malicious code with the privileges assigned to the web service process. This effectively grants the attacker full control over the underlying operating system, allowing for data exfiltration, defacement, lateral movement within the network, or the establishment of persistent backdoors.
From a classification perspective, this vulnerability aligns closely with CWE-434, which describes the Unrestricted Upload of File with Dangerous Type. The failure to validate file types allows dangerous executable content to be stored in sensitive locations. Furthermore, the exploitation technique maps directly to MITRE ATT&CK techniques related to Web Shell Deployment and Command Line Interface execution via web applications. Attackers utilize this method as a common initial access or persistence mechanism because it provides a straightforward path from authenticated user interaction to arbitrary code execution without requiring additional privilege escalation steps beyond the existing editor role permissions.
Mitigation strategies must address both immediate remediation and long-term architectural improvements. The most effective solution is to upgrade all affected systems to their latest stable versions where this flaw has been patched by the vendors. If upgrading is not immediately feasible, administrators should implement strict file upload restrictions at the web server level or via application configuration files. This includes configuring the /public/image directory to disable script execution entirely, ensuring that PHP handlers do not process files within that specific path regardless of their extension. Additionally, implementing a robust allowlist for accepted image formats and validating both the file extension and magic bytes is essential. Security teams should also enforce principle of least privilege by restricting editor accounts from uploading any files directly into web-accessible directories, instead routing uploads through a dedicated media processing service that sanitizes content before storage in secure, non-executable locations.