Description

A security vulnerability has been detected in ShopEx ECShop up to 2.5.1. This vulnerability affects the function flow_update_cart of the file /flow.php?step=update_cart. The manipulation of the argument rec_id leads to sql injection. The attack can be initiated remotely. The exploit has been disclosed publicly and may be used. The vendor was contacted early about this disclosure but did not respond in any way.

Executive Summary

Technical Details

Mitigations

References

Additional Metadata

{
  "score": "7.3",
  "pubDate": "2026-08-31T22:17:33.907Z",
  "pubdate": "2026-08-31T22:17:33.907Z",
  "executiveSummary": "A critical SQL injection vulnerability exists in ShopEx ECShop versions up to 2.5.1, specifically within the flow_update_cart function.\nThis vulnerability allows remote, unauthenticated attackers to manipulate database queries by injecting malicious SQL code through the rec_id argument.\nThe flaw stems from insufficient input validation of user-supplied data before passing it to the database management system.\nSuccessful exploitation grants an attacker the ability to interact with the underlying database, potentially leading to unauthorized data exposure, modification, or deletion.\nThe vulnerability is publicly disclosed, increasing the risk of active exploitation. The vendor has not provided a response or resolution regarding this security flaw.",
  "technicalDetails": "The vulnerability is located in /flow.php?step=update_cart within the ShopEx ECShop application. The primary root cause is improper sanitization of the rec_id parameter before its inclusion in a SQL query executed by the application backend.\nThe function flow_update_cart fails to implement adequate parameterized queries or utilize prepared statements when handling the rec_id argument. Consequently, the input is treated as part of the SQL command structure rather than a literal value, allowing for arbitrary command execution.\nAn attacker can exploit this by crafting a malicious HTTP request directed at /flow.php with the step parameter set to update_cart and providing an engineered payload within the rec_id parameter. By utilizing SQL injection techniques, such as UNION-based or boolean-based blind injection, the attacker can manipulate the query logic to bypass standard database operations.\nThe attack flow proceeds as follows: 1) The attacker initiates a request to the vulnerable endpoint /flow.php?step=update_cart. 2) The application parses the rec_id parameter without verifying its structure or type. 3) The malicious input is concatenated into a SQL statement processed by the database layer. 4) The database engine executes the injected commands, which may result in unauthorized data retrieval from the database, such as administrator credentials, session information, or customer order history. 5) The results of the malicious query are returned to the attacker's client, facilitating further unauthorized access or complete system compromise depending on database permissions.\nThe vulnerability is accessible remotely without the requirement for prior authentication or elevated system privileges, making it a high-risk entry point for attackers targeting the database. Because the input vector is processed directly by the web application component, it constitutes a severe security weakness in the data access layer. Post-exploitation, an attacker can leverage the ability to execute arbitrary SQL commands to extract the entire database content, escalate privileges by modifying administrative accounts, or in some configurations, execute stored procedures or interact with the underlying operating system."
}