The exploit demonstrates a database backup disclosure vulnerability in qEngine CMS 6.0.0 by brute-forcing predictable backup filenames in the '/admin/backup' directory. It also includes details for a Local File Inclusion (LFI) vulnerability and a Remote Code Execution (RCE) vulnerability via file upload.
Classification
Working Poc 95%
Attack Type
Info Leak
Complexity
Trivial
Reliability
Reliable
Target:qEngine CMS 6.0.0 and 4.1.6
No auth needed
Prerequisites:Access to the target web server · Predictable backup file naming convention