iWebShop-5 CVE-2026-112032

Exploitation targets the Util::search function in classes/util.php of iWebShop-5 versions up to 5.16, where a search input is concatenated into a SQL query without proper neutralization. The vendor-supplied CVSS vector requires PR:H, meaning a pre-existing high-privileged (e.g., administrative) authenticated session is needed, which significantly limits realistic exploitation to insiders or attackers with stolen privileged credentials; no user interaction is required (UI:N). The exploit is network-reachable (AV:N) with low complexity (AC:L). A limiting caveat: the actual privilege level required should be confirmed from source, since search functionality is frequently exposed to lower-privileged or anonymous users, which would contradict the stated PR:H.

This is a low-priority issue despite being a remotely exploitable SQL injection. The VulDB-assigned CVSS 4.0 vector (AV:N/AC:L/AT:N/PR:H/UI:N) scores only 2.0 because it requires high privileges (PR:H) and yields only low impact to confidentiality, integrity, and availability (VC:L/VI:L/VA:L). The vector embeds E:P (Proof-of-Concept), consistent with the description's claim that a public exploit exists. There is no CISA KEV listing and no EPSS score in the provided data, so there is no evidence of active or widespread exploitation - exploitation status is limited to publicly available exploit code. Note a tension worth verifying: SQL injection in a product 'search' function is commonly reachable pre-authentication, yet the vendor-supplied vector asserts PR:H; if the search endpoint is in fact unauthenticated, real-world severity would be higher than the 2.0 score suggests - verify the authentication requirement against the source code at classes/util.php. Overall, given the obscure product and high stated privilege requirement, this is a high-visibility-but-low-real-risk issue rather than an urgent threat.

An authenticated, high-privileged user of an iWebShop-5 deployment (≤5.16) submits a crafted search parameter that is passed unsanitized into Util::search, injecting SQL to read or minimally alter backend database records. A public proof-of-concept is referenced via the VulDB submission, lowering the effort to reproduce. Because the attack is network-reachable but needs existing elevated privileges, practical exploitation is constrained to insiders or attackers who have already obtained a privileged account.