CVE-2014-125137
Received Received - Intake

Local File Inclusion in qEngine CMS, Kemana Directory, and Cart Engine

Publication date: 2026-10-28

Last updated on: 2026-10-28

Assigner: VulnCheck

Description
C97net qEngine CMS through 6.0.0, Kemana Directory through 1.5.6, and Cart Engine through 3.0.0 contain a local file inclusion vulnerability in the run parameter of admin/task.php. Authenticated administrators can supply directory traversal sequences in the run parameter to include and disclose local files readable by the web server.

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published
2026-10-28
Last Modified
2026-10-28
Generated
2026-10-28
AI Q&A
2026-10-28
EPSS Evaluated
N/A
NVD
CVE-2014-125137
EUVD
EUVD-2014-9838

Affected Vendors & Products

Showing 3 associated CPEs
Vendor Product Version / Range
C97net qEngine CMS 0
C97net Kemana Directory 0
C97net Cart Engine 0

Helpful Resources

Exploitability

CWE
CWE Icon
KEV
KEV Icon
CWE ID Description
CWE-98 The PHP application receives input from an upstream component, but it does not restrict or incorrectly restricts the input before its usage in "require," "include," or similar functions.

Attack-Flow Graph

AI Quick Actions

Instant insights powered by AI
Executive Summary

This vulnerability affects three C97net products: qEngine CMS (up to 6.0.0), Kemana Directory (up to 1.5.6), and Cart Engine (up to 3.0.0). It allows authenticated administrators to exploit directory traversal in the run parameter of admin/task.php to include and disclose local files readable by the web server.

Detection Guidance

Check for vulnerable software versions of C97net qEngine CMS, Kemana Directory, or Cart Engine. Inspect admin/task.php for improper input handling in the run parameter. Look for unusual file inclusion attempts in server logs.

Impact Analysis

An attacker with admin access could read sensitive files on the server, such as configuration files, credentials, or other confidential data. This could lead to further compromise of the system or data breaches.

Compliance Impact

This vulnerability could result in unauthorized access to personal or sensitive data, violating GDPR and HIPAA requirements for data protection and confidentiality. Non-compliance may lead to legal penalties and reputational damage.

Mitigation Strategies

Update affected software to patched versions. Restrict access to admin/task.php to trusted users only. Implement input validation to block directory traversal sequences in the run parameter.

Chat Assistant

Ask questions about this CVE
Hi! I’m here to help you understand CVE-2014-125137. Ask me anything about the vulnerability, its impact, or mitigation strategies.
0/70

EPSS Chart