Attack Chain

1. Attacker identifies a target server running an unpatched version of ShopEx ECShop (<= 2.5.1).
2. Attacker performs reconnaissance to locate the admin/pack.php script.
3. Attacker crafts a malicious payload (e.g., a PHP web shell) embedded within an image file structure.
4. Attacker sends a crafted HTTP POST request to the admin/pack.php endpoint.
5. Attacker manipulates the pack_img argument within the request to bypass server-side file type checks in check_img_type.
6. The server saves the malicious file to the web root or an accessible upload directory.
7. Attacker navigates to the uploaded file's URL to trigger code execution on the server.
8. Attacker establishes persistent access or begins data exfiltration.

Impact

Successful exploitation allows for arbitrary file uploads, which provides a direct path for remote code execution. This can result in complete system compromise, unauthorized data access, and lateral movement within the network. Sectors relying on ECShop for e-commerce operations are at high risk of site defacement, financial data theft, and loss of customer information.

Recommendation

Prioritized actions for detection engineering and security teams:

• Implement strict ingress filtering for the /admin/ directory to ensure it is not reachable from the public internet.
• Deploy the provided Sigma rule to detect suspicious HTTP requests targeting the admin/pack.php script.
• Monitor web server access logs for anomalous POST requests to admin/pack.php that contain unexpected file extensions or script contents.
• Configure file integrity monitoring on the web server's document root to alert on the creation of new executable files in upload directories.