AI Shopping Assistant Flaws Let Attackers Execute Code on Retailer’s Backend Servers