The vulnerability is an unrestricted file upload in administrative image fields that allows users with an Editor role to upload PHP scripts through the page_image or cat_image parameters. Once uploaded to the web‑accessible /public/image directory, these scripts can be executed by the application, giving the attacker full control over the server. This flaw is a classic example of a file upload flaw (CWE-434). The principal consequence is code execution on the host, which can be used to compromise the entire system.

The affected products are C97net qEngine CMS versions 6.0.0 and earlier, Kemana Directory versions 1.5.6 and earlier, and Cart Engine versions 3.0.0 and earlier. Users needing to upload images within the administrative interface are potentially exploited. The upload is available through a web interface that writes uploaded files to the /public/image directory.

The vulnerability carries a CVSS score of 8.7, indicating high severity. EPSS data is not available, and the vulnerability is not listed in the CISA KEV catalog. Attackers can exploit the flaw over the network by authenticating as an Editor and submitting a PHP payload. The attack requires only the ability to reach the upload endpoint, making it relatively low cost to execute once credentials are obtained. Given the high potential impact and ease of exploitation under the right conditions, the risk remains significant.