C97net qEngine CMS arbitrary file upload vulnerability

C97net qEngine CMS versions 6.0.0 and earlier, Kemana Directory versions 1.5.6 and earlier, and Cart Engine versions 3.0.0 and earlier contain an arbitrary file upload vulnerability. This vulnerability arises from unrestricted file uploads in the image management field; users with edit permission...