---
id: CVE-2014-125136
title: >-
  C97net qEngine CMS through 6.0.0, Kemana Directory through 1.5.6, Cart Engine
  through 3.0.0 Database Backup Exposure via /admin/backup
summary: >-
  C97net qEngine CMS through 6.0.0, Kemana Directory through 1.5.6, and Cart
  Engine through 3.0.0 contain an information disclosure vulnerability that
  exposes database backups in the web-accessible /admin/backup directory.
  Unauthenticated …
severity: medium
cvss: 5.9
cvssVector: 'CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:N/A:N'
cvssSource: cna
cwe:
  - CWE-530
vendor: C97net
product: qEngine CMS
affected:
  - qengine_cms <= 6.0.0
  - kemana_directory <= 1.5.6
  - cart_engine <= 3.0.0
ssvc:
  exploitation: poc
  automatable: 'no'
  technicalImpact: partial
  timestamp: '2026-10-28T15:57:49.444303Z'
exploitAvailable: true
published: '2026-10-28'
updated: '2026-10-28'
sourceUpdated: '2026-10-28T16:12:26.616Z'
source: CVEORG
sourceUrl: 'https://www.cve.org/CVERecord?id=CVE-2014-125136'
references:
  - url: 'https://www.zeroscience.mk/advisories/ZSL-2014-5172.html'
    label: >-
      Zero Science Lab Advisory ZSL-2014-5172: qEngine CMS 6.0.0 Database Backup
      Disclosure Exploit
  - url: 'https://www.zeroscience.mk/advisories/ZSL-2014-5176.html'
    label: >-
      Zero Science Lab Advisory ZSL-2014-5176: Kemana Directory 1.5.6 Database
      Backup Disclosure Exploit
  - url: 'https://www.zeroscience.mk/advisories/ZSL-2014-5180.html'
    label: >-
      Zero Science Lab Advisory ZSL-2014-5180: Cart Engine 3.0.0 Database Backup
      Disclosure Exploit
  - url: 'https://www.exploit-db.com/exploits/32511'
    label: 'ExploitDB-32511: qEngine CMS 6.0.0 Multiple Vulnerabilities'
  - url: 'https://www.exploit-db.com/exploits/32509'
    label: 'ExploitDB-32509: Kemana Directory 1.5.6 Database Backup Disclosure'
  - url: 'https://www.exploit-db.com/exploits/32505'
    label: 'ExploitDB-32505: Cart Engine 3.0.0 Database Backup Disclosure'
  - url: >-
      https://www.vulncheck.com/advisories/c97net-qengine-cms-through-6.0.0-kemana-directory-through-1.5.6-cart-engine-through-3.0.0-database-backup-exposure-via-admin-backup
    label: >-
      VulnCheck Advisory: C97net qEngine CMS through 6.0.0, Kemana Directory
      through 1.5.6, Cart Engine through 3.0.0 Database Backup Exposure via
      /admin/backup
tags:
  - cve.org
  - exploit-available
epss: 0.00412
epssPercentile: 0.35333
ingestedAt: '2026-10-28T03:02:57.633Z'
---

## Overview

C97net qEngine CMS through 6.0.0, Kemana Directory through 1.5.6, and Cart Engine through 3.0.0 contain an information disclosure vulnerability that exposes database backups in the web-accessible /admin/backup directory. Unauthenticated attackers can list the directory or guess date-based names like 'Full Backup YYYYMMDD.sql' to download dumps containing user records and administrator password hashes.

## Affected

- `qengine_cms <= 6.0.0`
- `kemana_directory <= 1.5.6`
- `cart_engine <= 3.0.0`

## Remediation

Refer to the linked advisories for vendor-supplied fixes and affected version ranges.