Vulnerability in C97net Cart Engine
CVE-2014-125137
C97net qEngine CMS through 6.0.0, Kemana Directory through 1.5.6, and Cart Engine through 3.0.0 contain a local file inclusion vulnerability in the run parameter of admin/task.php. Authenticated administrators can supply directory traversal sequences in the run parameter to include and disclose local files readable by the web server.
Published · last modified .
CVSS v3 metric
CVSS v3 base score 6.5 (Medium). Vector: CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N.
EPSS exploit prediction
EPSS: 0.007 (53.7th percentile), scored .
Very low probability of exploitation in the next 30 days; routine patching cadence is appropriate. 54th percentile — 53.7% of CVEs in the catalogue have a lower EPSS than this one. How to read EPSS.
The 30-day trend appears once there are two daily scores.
Affected products
Weakness classification (CWE)
References
- www.zeroscience.mk/advisories/ZSL-2014-5173.html (third-party-advisory)
- www.zeroscience.mk/advisories/ZSL-2014-5177.html (third-party-advisory)
- www.zeroscience.mk/advisories/ZSL-2014-5181.html (third-party-advisory)
- www.exploit-db.com/exploits/32511 (exploit)
- www.exploit-db.com/exploits/39129 (exploit)
- www.exploit-db.com/exploits/32508 (exploit)
- www.exploit-db.com/exploits/32504 (exploit)
- www.vulncheck.com/advisories/c97net-qengine-cms-through-6.0.0-kemana-directory-… (third-party-advisory)
Frequently asked questions
- What is CVE-2014-125137?
- CVE-2014-125137 is a medium-severity vulnerability in C97net Cart Engine, classified under PHP Remote File Inclusion. CVSS score: 6.5/10. Published 2026-10-28.
- How severe is CVE-2014-125137?
- Medium severity. CVSS v3 base score is 6.5 out of 10.