| शीर्षक | ShopEx Software Co., Ltd ECShop v2.5.1 Command Injection |
|---|
| विवरण | 1. Product Introduction
ECShop is an open-source B2C independent online store system developed by ShopEx Software Co., Ltd. Released in 2006, it has served more than one million enterprises and is dedicated to rapid deployment of personalized online shopping malls.
- Official Website: https://www.ecshop.com/
- Download URL: https://down.chinaz.com/soft/20737.htm
- Affected Version: v2.5.1
Vulnerability Root Cause
Developers mistakenly assumed that array keys passed from HTTP requests would only be integer rec_id values and failed to implement filtering for array keys. Attackers can pass arbitrary strings as array keys in HTTP requests, which are directly spliced into SQL statements, resulting in SQL injection vulnerabilities. |
|---|
| स्रोत | ⚠️ https://uvxbywu62qm.feishu.cn/wiki/NWyrwRgmgi9DxDk5Hy1cARKfnsc?from=from_copylink |
|---|
| उपयोगकर्ता | hubdk01 (UID 99481) |
|---|
| सबमिशन | 03/07/2026 08:09 PM (2 महीनों पहले) |
|---|
| संयम | 31/08/2026 01:34 PM (2 months later) |
|---|
| स्थिति | स्वीकृत |
|---|
| VulDB प्रविष्टि | 397302 [ShopEx ECShop तक 2.5.1 flow.php?step=update_cart flow_update_cart rec_id SQL इंजेक्शन] |
|---|
| अंक | 20 |
|---|