Description
C97net qEngine CMS through 6.0.0, Kemana Directory through 1.5.6, and Cart Engine through 3.0.0 contain an information disclosure vulnerability that exposes database backups in the web-accessible /admin/backup directory. Unauthenticated attackers can list the directory or guess date-based names like 'Full Backup YYYYMMDD.sql' to download dumps containing user records and administrator password hashes.
Affected products
| Vendor | Product | Affected | Fixed |
|---|---|---|---|
| C97net | qEngine CMS | ≤ 6.0.0 | — |
| C97net | Kemana Directory | ≤ 1.5.6 | — |
| C97net | Cart Engine | ≤ 3.0.0 | — |
References
- Zero Science Lab Advisory ZSL-2014-5172: qEngine CMS 6.0.0 Database Backup Disclosure Exploit third-party-advisory
- Zero Science Lab Advisory ZSL-2014-5176: Kemana Directory 1.5.6 Database Backup Disclosure Exploit third-party-advisory
- Zero Science Lab Advisory ZSL-2014-5180: Cart Engine 3.0.0 Database Backup Disclosure Exploit third-party-advisory
- ExploitDB-32511: qEngine CMS 6.0.0 Multiple Vulnerabilities exploit
- ExploitDB-32509: Kemana Directory 1.5.6 Database Backup Disclosure exploit
- ExploitDB-32505: Cart Engine 3.0.0 Database Backup Disclosure exploit
- VulnCheck Advisory: C97net qEngine CMS through 6.0.0, Kemana Directory through 1.5.6, Cart Engine through 3.0.0 Database Backup Exposure via /admin/backup third-party-advisory