Description
C97net qEngine CMS through 6.0.0, Kemana Directory through 1.5.6, and Cart Engine through 3.0.0 contain a local file inclusion vulnerability in the run parameter of admin/task.php. Authenticated administrators can supply directory traversal sequences in the run parameter to include and disclose local files readable by the web server.
Affected products
| Vendor | Product | Affected | Fixed |
|---|---|---|---|
| C97net | qEngine CMS | ≤ 6.0.0 | — |
| C97net | Kemana Directory | ≤ 1.5.6 | — |
| C97net | Cart Engine | ≤ 3.0.0 | — |
References
- Zero Science Lab Advisory ZSL-2014-5173: qEngine CMS 6.0.0 (task.php) Local File Inclusion Vulnerability third-party-advisory
- Zero Science Lab Advisory ZSL-2014-5177: Kemana Directory 1.5.6 (run param) Local File Inclusion Vulnerability third-party-advisory
- Zero Science Lab Advisory ZSL-2014-5181: Cart Engine 3.0.0 (task.php) Local File Inclusion Vulnerability third-party-advisory
- ExploitDB-32511: qEngine CMS 6.0.0 Multiple Vulnerabilities exploit
- ExploitDB-39129: qEngine 4.1.6/6.0.0 'task.php' Local File Inclusion exploit
- ExploitDB-32508: Kemana Directory 1.5.6 'task.php' Local File Inclusion exploit
- ExploitDB-32504: Cart Engine 3.0.0 'task.php' Local File Inclusion exploit
- VulnCheck Advisory: C97net qEngine CMS through 6.0.0, Kemana Directory through 1.5.6, Cart Engine through 3.0.0 Local File Inclusion via admin/task.php third-party-advisory