CVE-2008-3412: Ecshop Epshop

High severity, CVSS 7.5. EPSS: 1% chance of exploitation in the next 30 days.

SQL injection vulnerability in Comsenz EPShop (aka ECShop) before 3.0 allows remote attackers to execute arbitrary SQL commands via the pid parameter in a (1) pro_show or (2) disppro action to the default URI.

Affected products

• Ecshop Epshop: up to and including 2.1.5; version 2.0.0 only; version 2.0.1 only; version 2.0.2 only; version 2.0.3 only; version 2.0.5 only; …

Published 2008-07-31. Last modified 2026-06-16.