ECTouch SQL Injection Scanner

ECTouch 2 is a mobile e-commerce platform designed for businesses to deliver seamless shopping experiences on smartphones and tablets. It is widely used by online retailers, from small stores to large enterprises, to manage product catalogs, orders, and customer data. The platform's modular architecture allows developers to customize features like payment gateways, shipping options, and user authentication, making it a flexible choice for mobile commerce deployments.

SQL Injection is a critical vulnerability that occurs when user-supplied data is improperly sanitized before being included in SQL queries. In ECTouch 2, this flaw arises from insufficient input validation in various modules, allowing attackers to inject malicious SQL commands. This can lead to unauthorized database access, data exfiltration, or even full system compromise.

Specifically, the vulnerability affects the user login and product search endpoints, where parameters such as 'username', 'password', and 'keyword' are directly concatenated into SQL queries without proper escaping. Attackers can craft payloads like ' OR '1'='1 to bypass authentication or use UNION-based injections to retrieve arbitrary data from the database.

If exploited, an attacker can gain complete control over the ECTouch 2 database, accessing sensitive customer information, order details, and admin credentials. This could result in data breaches, financial loss, and reputational damage. In severe cases, the attacker may escalate privileges to execute operating system commands, compromising the entire server.