A weakness has been identified in ShopEx ECShop up to 2.5.1. This affects the function check_img_type of the file admin/pack.php. Executing a manipulation of the argument pack_img can lead to unrestricted upload. It is possible to launch the attack remotely. The exploit has been made available to the public and could be used for attacks. The vendor was contacted early about this disclosure but did not respond in any way.

A vulnerability has been identified in ShopEx ECShop versions up to 2.5.1 involving an unrestricted file upload flaw. The vulnerability exists in the check_img_type function within the admin/pack.php file. Attackers can manipulate the pack_img argument to bypass file type restrictions and upload arbitrary files. The attack can be launched remotely without requiring physical access. A public exploit has already been released, increasing the risk of active exploitation. The vendor was notified prior to public disclosure but did not respond. This lack of vendor response leaves users without an official patch or mitigation guidance. The vulnerability poses significant risk to e-commerce platforms running affected ECShop versions.