Description

A weakness has been identified in ShopEx ECShop up to 2.5.1. This affects the function check_img_type of the file admin/pack.php. Executing a manipulation of the argument pack_img can lead to unrestricted upload. It is possible to launch the attack remotely. The exploit has been made available to the public and could be used for attacks. The vendor was contacted early about this disclosure but did not respond in any way.

Executive Summary

Technical Details

Mitigations

References

Additional Metadata

{
  "score": "7.3",
  "pubDate": "2026-08-31T22:17:33.740Z",
  "pubdate": "2026-08-31T22:17:33.740Z",
  "executiveSummary": "This vulnerability is an unrestricted file upload flaw identified within ShopEx ECShop versions up to 2.5.1.\nThe vulnerability resides in the admin/pack.php file, specifically within the check_img_type function.\nAn attacker can exploit this remotely by manipulating the pack_img argument to bypass file type validation mechanisms.\nSuccessful exploitation allows for the unauthorized upload of arbitrary files, which may lead to remote code execution (RCE) if the uploaded file is processed or executed by the web server.\nThe risk is critical, as the vulnerability is publicly disclosed, facilitating potential exploitation by malicious actors.\nThe vendor was notified of the disclosure but provided no response, leaving affected installations at continued risk.\nExploitation does not inherently require prior authentication depending on the specific configuration of the administrative interface exposed to the network.",
  "technicalDetails": "The vulnerability is located in admin/pack.php within the check_img_type function, which fails to adequately sanitize or validate user-supplied file inputs provided through the pack_img argument.\nThe core issue is a failure in the logic responsible for ensuring that uploaded files conform to expected image formats, allowing an attacker to inject malicious files despite the intended security controls.\nThe exploitation flow begins when an attacker crafts a malicious request targeting the admin/pack.php endpoint.\nBy manipulating the pack_img parameter, an attacker can bypass the server-side checks that are intended to restrict file uploads to legitimate image types.\nBecause the server does not enforce strict validation of the file content or extension, it is possible to upload arbitrary file types, such as PHP scripts, onto the server's filesystem.\nOnce the file is uploaded, the attacker can leverage the web server's execution environment to trigger the malicious payload by accessing the uploaded file directly via its URL path.\nThe vulnerability is remotely exploitable, meaning that an attacker does not require local access to the server to initiate the compromise.\nThis unrestricted file upload grants the attacker the capability to achieve remote code execution, which can subsequently lead to full system compromise, data exfiltration, or the establishment of a persistent backdoor.\nThe lack of robust input validation and the absence of a restrictive white-list mechanism for file extensions and MIME types within the check_img_type function are the primary technical drivers for this security failure.\nPost-exploitation, the impact is severe, as the attacker gains the ability to execute system-level commands with the privileges of the web server process, potentially allowing lateral movement within the hosting infrastructure."
}