iWebShop-5 Multiple Vulnerability Classes

Cross-site request forgery in aircheng-org iWebShop-5 through 5.16 allows an attacker to change an administrator password when a logged-in admin is induced to load attacker-controlled content; the affected code is admin_repwd_act in controllers/system.php. Publicly available exploit code exists (GitHub issue #9), but CISA KEV does not confirm active exploitation, and impact is limited because the attacker must rely on a live admin session and gains no direct access. The vendor has not responded and no fixed version is identified.

Manipulating the user_id argument in iWebShop-5 up to 5.16's send_message_mobile function (controllers/simple.php) can abuse weak password-recovery logic and potentially allow unauthorized password recovery for another account. The flaw is remotely reachable with low impact, publicly available exploit code exists, and independent assessment rates it a moderate, low-priority issue rather than an urgent one.

Open redirect in aircheng-org iWebShop-5 through 5.16 lets remote attackers craft a link that sends victims to an attacker-controlled site via the callback argument of IController::redirect in plugins/_userInfo/_userInfo.php. No authentication is required, but the victim must interact with the crafted URL (UI:P), and publicly available exploit code exists. The impact is limited to browser redirection for phishing or trust abuse, with no server-side code execution or data disclosure.

SQL injection in iWebShop-5 up to 5.16 via the Util::search function in classes/util.php allows a high-privileged authenticated remote attacker to manipulate database queries, with limited confidentiality, integrity, and availability impact. Publicly available exploit code exists, but active exploitation is not confirmed (no KEV listing provided). The vendor has not responded to the issue report, and the required administrative session significantly limits practical risk.