← Advisories

qEngine CMS 6.0.0 Database Backup Disclosure Exploit

Medium
Advisory ID
ZSL-2014-5172
Release Date
25 March 2014
Vendor
Affected Version
6.0.0 and 4.1.6
CVE
N/A
Tested On
Apache/2.4.7 (Win32), PHP/5.5.6, MySQL 5.6.14
Summary

qEngine (qE) is a lightweight, fast, yet feature packed CMS script to help you building your site quickly. Using template engine to separate the php codes from the design, you don't need to touch the codes to design your web site. qE is also expandable by using modules.

Description

qEngine CMS stores database backups using the Backup DB tool with a predictable file name inside the '/admin/backup' directory as 'Full Backup YYYYMMDD.sql' or 'Full Backup YYYYMMDD.gz', which can be exploited to disclose sensitive information by downloading the file. The '/admin/backup' is also vulnerable to directory listing by default.

Proof of Concept
Disclosure Timeline
07.03.2014Vulnerability discovered.
10.03.2014Vendor contacted.
11.03.2014Vendor responds asking more details.
11.03.2014Sent details to the vendor.
12.03.2014Working with the vendor.
13.03.2014Vendor working on a new version.
21.03.2014Asked vendor for status update.
21.03.2014Vendor promises patch release in April.
25.03.2014Public security advisory released.
31.05.2014Vendor releases version 7 to address this issue.
Credits
Vulnerability discovered by Gjoko Krstic
References
Changelog
25.03.2014Initial release
26.03.2014Added reference [6] and [7]
27.03.2014Added reference [8]
31.03.2014Added reference [9]
31.05.2014Added vendor status and reference [10]