C97net qEngine CMS through 6.0.0, Kemana Directory through 1.5.6, Cart Engine through 3.0.0 Unrestricted File Upload via Image Fields
Impact
C97net qEngine CMS through 6.0.0, Kemana Directory through 1.5.6, and Cart Engine through 3.0.0 contain an unrestricted file upload vulnerability in administrative image fields. Editor-role users can upload PHP scripts via the page_image or cat_image parameters to the web-accessible /public/image directory and request them to execute code on the server.
Source excerpt · VulnCheckAffected packages
Affected products
Vendor version evidence. Product records are separate from automatic dependency matching.
C97net · qEngine CMS
Other versions: unaffected
| Version / range | Source status |
|---|---|
| 0 through 6.0.0 (inclusive) | affected |
C97net · Kemana Directory
Other versions: unaffected
| Version / range | Source status |
|---|---|
| 0 through 1.5.6 (inclusive) | affected |
C97net · Cart Engine
Other versions: unaffected
| Version / range | Source status |
|---|---|
| 0 through 3.0.0 (inclusive) | affected |
Original source description
C97net qEngine CMS through 6.0.0, Kemana Directory through 1.5.6, and Cart Engine through 3.0.0 contain an unrestricted file upload vulnerability in administrative image fields. Editor-role users can upload PHP scripts via the page_image or cat_image parameters to the web-accessible /public/image directory and request them to execute code on the server.
References
- Security advisory www.zeroscience.mk/advisories/ZSL-2014-5174.html
- Security advisory www.zeroscience.mk/advisories/ZSL-2014-5178.html
- Security advisory www.zeroscience.mk/advisories/ZSL-2014-5182.html
- Public exploit reference www.exploit-db.com/exploits/32511
- Public exploit reference www.exploit-db.com/exploits/32507
- Public exploit reference www.exploit-db.com/exploits/32503
- Security advisory www.vulncheck.com/advisories/c97net-qengine-cms-through-6.0.0-kemana-directory-through-1.5.6-cart-engine-through-3.0.0-unrestricted-file-upload-via-image-fields