iWebShop-5 EUVD-2026-104027

Exploitation targets the 'callback' argument of the IController::redirect function in plugins/_userInfo/_userInfo.php (the Login Redirect component) of iWebShop-5 versions up to and including 5.16. No authentication is required (PR:N), but exploitation is NOT fully automatic: it requires victim user interaction (UI:P) - the target must follow the attacker-supplied crafted link for the unvalidated redirect to fire. The limiting factors are therefore the need for social engineering to get a user to click, and the requirement that the target run a vulnerable iWebShop-5 installation (<=5.16) with the _userInfo login-redirect plugin in use. Impact is confined to redirecting the victim's browser (phishing/trust abuse); there is no direct server-side code execution or data disclosure.

This is a low-to-moderate severity open redirect (CWE-601) in the aircheng-org iWebShop-5 e-commerce platform, and the available signals are largely consistent with a real-but-low-priority issue rather than an urgent one. The CVSS 4.0 vector (AV:N/AC:L/AT:N/PR:N/UI:P/VC:N/VI:L/VA:N) scores 5.3 and confirms a network-exploitable, unauthenticated flaw with no complexity barrier but requiring passive user interaction (UI:P) - the victim must click or follow an attacker-crafted link. Impact is limited to a low integrity effect (VI:L) with no confidentiality or availability impact, which matches the nature of an open redirect: it enables phishing and trust abuse rather than direct system compromise. On the exploitation-maturity side, the vector carries E:P (proof-of-concept) and the input confirms publicly available exploit code exists, so this is 'publicly available exploit code exists' - NOT active exploitation. There is no CISA KEV listing and no EPSS score provided, so widespread automated exploitation cannot be asserted from the data. The SSVC-relevant signals (unauthenticated remote access, but low technical impact and required user interaction) point to opportunistic phishing use rather than a wormable or high-impact bug. Net: a legitimate, patch-worthy weakness, but not a drop-everything priority, especially given the niche product footprint. Note the data gap: this is sourced solely from VulDB with no vendor response (the project was notified via a GitHub issue but has not replied), so no official fix exists yet.

An attacker crafts a malicious URL pointing at a legitimate iWebShop-5 site's login redirect endpoint, setting the 'callback' parameter to an attacker-controlled domain, then delivers it via phishing email or a malicious link. When a victim clicks the trusted-looking link, the application redirects their browser to the attacker's site, which can harvest credentials or deliver malware. Public exploit code for this flaw is already available, lowering the barrier to abuse.