A critical unrestricted file upload vulnerability in ShopEx ECShop allows remote unauthenticated attackers to execute arbitrary file uploads, posing a significant risk of system compromise.

The application fails to properly validate file types within the check_img_type function in admin/pack.php, permitting an unauthenticated remote attacker to manipulate the pack_img argument to upload arbitrary files.

Successful exploitation of this vulnerability allows unauthorized users to upload malicious files to the server, which can lead to remote code execution or complete system takeover. Given the CVSS score of 7.3, this flaw represents a high risk to business operations, potentially resulting in data exfiltration, permanent service disruption, and severe reputational damage to the organization.

Immediate Action: Since no official patch is currently available from the vendor, administrators should immediately restrict access to the admin/pack.php endpoint or disable the affected functionality.

Proactive Monitoring: Review web server access logs for suspicious POST requests targeting admin/pack.php and monitor the file system for unexpected files uploaded to the web directory.

Compensating Controls: Implement a Web Application Firewall (WAF) rule to block requests containing malicious file signatures or unauthorized attempts to access the vulnerable admin/pack.php file.

Public Exploit Available: Yes, a published proof of concept exists, as evidenced by the technical documentation provided in the enrichment references.

Due to the lack of a vendor patch and the presence of a publicly available exploit, organizations running ShopEx ECShop 2.5.0 or 2.5.1 must treat this as a high priority. Administrators should apply the recommended compensating controls immediately to prevent potential unauthorized access while awaiting further guidance or official security updates.