C97net qEngine CMS through 6.0.0, Kemana Directory through 1.5.6, Cart Engine through 3.0.0 Unrestricted File Upload via Image Fields

Summary

C97net qEngine CMS through 6.0.0, Kemana Directory through 1.5.6, and Cart Engine through 3.0.0 contain an unrestricted file upload vulnerability in administrative image fields. Editor-role users can upload PHP scripts via the page_image or cat_image parameters to the web-accessible /public/image directory and request them to execute code on the server.

Remediation

1. Inventory every C97net qEngine CMS deployment, including staging.
2. No fixed version appears in the public sources yet. Check the references below and the vendor directly.

References

• Advisoryhttps://www.vulncheck.com/advisories/c97net-qengine-cms-through-6.0.0-kemana-directory-through-1.5.6-cart-engine-through-3.0.0-unrestricted-file-upload-via-image-fields
• Advisoryhttps://www.zeroscience.mk/advisories/ZSL-2014-5174.html
• Advisoryhttps://www.zeroscience.mk/advisories/ZSL-2014-5178.html
• Advisoryhttps://www.zeroscience.mk/advisories/ZSL-2014-5182.html
• Referencehttps://www.exploit-db.com/exploits/32503
• Referencehttps://www.exploit-db.com/exploits/32507
• Referencehttps://www.exploit-db.com/exploits/32511