Executive brief
ECShop is an e-commerce platform that manages shopping carts and product orders. A SQL injection vulnerability in the cart update function allows remote attackers to manipulate database queries, potentially exposing sensitive customer data, compromising payment information, or disrupting store operations without requiring authentication.
Technical details
The vulnerability is a SQL injection flaw in the flow_update_cart function within /flow.php?step=update_cart. An attacker can inject malicious SQL code through the rec_id parameter to manipulate database queries. The vulnerability is remotely exploitable without authentication, and proof-of-concept code has been publicly disclosed. The vendor (ShopEx) was contacted early about the disclosure but did not respond or issue a patch.
Affected products
- ShopEx ECShop up to 2.5.1
Timeline
- 2026-08-31: disclosed
- 2026-08-31: advisory