An unauthenticated SQL injection vulnerability in ShopEx ECShop versions 2.5.0 and 2.5.1 poses a significant risk of unauthorized database interaction.

This is an SQL injection vulnerability (CWE-89) located in the flow_update_cart function within the /flow.php script. An unauthenticated remote attacker can inject malicious SQL commands by manipulating the rec_id parameter.

Successful exploitation allows an attacker to interact directly with the backend database, potentially leading to the unauthorized disclosure, modification, or deletion of sensitive e-commerce data. Given the CVSS score of 7.3, this high-severity flaw could lead to significant data breaches and compromise the integrity of the application.

Immediate Action: As no official patch is available from the vendor, restrict access to the /flow.php endpoint at the network or web server level.

Proactive Monitoring: Monitor web server access logs for suspicious input patterns in the rec_id parameter and query strings containing SQL syntax.

Compensating Controls: Deploy a Web Application Firewall (WAF) with rules specifically configured to detect and block SQL injection attempts against the /flow.php endpoint.

Public Exploit Available: Yes, a published proof-of-concept exists, as documented in the technical write-up provided in the vulnerability references.

Due to the lack of an official vendor patch and the presence of a public proof-of-concept, users of ShopEx ECShop must treat this vulnerability as a high priority. Administrators should implement strict access controls or WAF rules to sanitize the affected parameter immediately to prevent potential database compromise.