Description
A security vulnerability has been detected in ShopEx ECShop up to 2.5.1. This vulnerability affects the function flow_update_cart of the file /flow.php?step=update_cart. The manipulation of the argument rec_id leads to sql injection. The attack can be initiated remotely. The exploit has been disclosed publicly and may be used. The vendor was contacted early about this disclosure but did not respond in any way.
Published: 2026-08-31
Score: 6.9 Medium
EPSS: n/a
KEV: No
Impact: n/a
Action: n/a
AI Analysis

Impact

This flaw allows untrusted users to inject arbitrary SQL through the rec_id parameter used by the flow_update_cart function in the /flow.php?step=update_cart endpoint. The injection can lead to unauthorized data disclosure, credential theft, or data manipulation.

Affected Systems

The issue exists in ShopEx ECShop versions up to and including 2.5.1. Attackers target the flow_update_cart function within the /flow.php file; no other products or versions are known to be affected.

Risk and Exploitability

The CVSS score of 6.9 indicates moderate to high severity. EPSS data is not available, so the likelihood of exploitation cannot be quantified from the current data, and the vulnerability is not listed in the CISA KEV catalog. The description states that the attack can be initiated remotely, implying that any party that can reach the application can exploit the rec_id parameter by sending a crafted HTTP request. The lack of a publicly available fix and the vendor’s unresponsiveness raise the risk that the flaw may remain in use for an extended period.

Generated by OpenCVE AI on August 31, 2026 at 22:50 UTC.

Remediation

No vendor fix or workaround currently provided.

OpenCVE Recommended Actions

  • Upgrade ECShop to any release newer than 2.5.1 or apply a vendor-provided hotfix as soon as it is available.
  • Use network controls to limit access to the /flow.php?step=update_cart endpoint to trusted IP ranges and block or restrict unauthenticated requests.
  • Assure that the application uses parameterized queries or proper input validation for the rec_id field to eliminate the injection path.

Generated by OpenCVE AI on August 31, 2026 at 22:50 UTC.

Tracking

Sign in to view the affected projects.

Advisories

No advisories yet.

History

Mon, 31 Aug 2026 21:45:00 +0000

Type Values Removed Values Added
Description A security vulnerability has been detected in ShopEx ECShop up to 2.5.1. This vulnerability affects the function flow_update_cart of the file /flow.php?step=update_cart. The manipulation of the argument rec_id leads to sql injection. The attack can be initiated remotely. The exploit has been disclosed publicly and may be used. The vendor was contacted early about this disclosure but did not respond in any way.
Title ShopEx ECShop flow.php flow_update_cart sql injection
First Time appeared Shopex
Shopex ecshop
Weaknesses CWE-74
CWE-89
CPEs cpe:2.3:a:shopex:ecshop:*:*:*:*:*:*:*:*
Vendors & Products Shopex
Shopex ecshop
References
Metrics cvssV2_0

{'score': 7.5, 'vector': 'AV:N/AC:L/Au:N/C:P/I:P/A:P/E:POC/RL:ND/RC:UR'}

cvssV3_0

{'score': 7.3, 'vector': 'CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:L/E:P/RL:X/RC:R'}

cvssV3_1

{'score': 7.3, 'vector': 'CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:L/E:P/RL:X/RC:R'}

cvssV4_0

{'score': 6.9, 'vector': 'CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:L/VI:L/VA:L/SC:N/SI:N/SA:N/E:P'}

Subscriptions

Shopex Ecshop
cve-icon MITRE

Status: PUBLISHED

Assigner: VulDB

Published:

Updated: 2026-08-31T21:30:36.877Z

Reserved: 2026-08-31T11:34:38.234Z

Link: CVE-2026-82922

cve-icon Vulnrichment

No data.

cve-icon NVD

Status : Received

Published: 2026-08-31T22:17:33.907

Modified: 2026-08-31T22:17:33.907

Link: CVE-2026-82922

cve-icon Redhat

No data.

cve-icon OpenCVE Enrichment

Updated: 2026-08-31T23:00:12Z

Weaknesses
  • CWE-74

    Improper Neutralization of Special Elements in Output Used by a Downstream Component ('Injection')

  • CWE-89

    Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection')