Iwebshop 5
Monthly
Cross-site scripting in aircheng-org iWebShop-5 through version 5.15 allows unauthenticated remote attackers to inject malicious JavaScript via the outerSrc and selectPhoto parameters of the uploadFile function in controllers/pic.php. Victim interaction is required to trigger script execution in the target's browser, resulting in limited integrity impact such as session hijacking or page defacement. A public proof-of-concept exists via a GitHub issue report; the project maintainer has not responded to the disclosure.
SQL injection in iWebShop-5 (versions 5.0-5.15) allows authenticated high-privilege users to manipulate database queries via the Search argument of the member_list function in controllers/member.php. The CVSS 4.0 vector (PR:H) confirms that administrative credentials are required, constraining the realistic attacker pool but not eliminating risk in multi-tenant or compromised-admin scenarios. A public exploit has been disclosed via a GitHub issue report, and the vendor has not responded to the responsible disclosure.
Unrestricted file upload in aircheng-org iWebShop-5 versions up to 5.15 allows remote unauthenticated attackers to upload arbitrary files - including PHP webshells - via the `upload_json` and `uploadFile` functions in `controllers/pic.php`. The CVSS 4.0 vector (AV:N/AC:L/AT:N/PR:N/UI:N) confirms zero-barrier network exploitation requiring no authentication or user interaction. A public proof-of-concept exploit has been disclosed via GitHub issue, and no vendor patch is available as the project has not responded to responsible disclosure.
Missing authorization in aircheng-org iWebShop-5 (all versions through 5.15) exposes the Update::index controller method in controllers/update.php to unauthenticated remote invocation, allowing any network-reachable attacker to trigger the application's update workflow without credentials. The CWE-862 flaw is confirmed by a public proof-of-concept filed in the project's GitHub issue tracker, and the vendor has not responded to disclosure. No CISA KEV listing exists, but active exploitation risk is elevated by the availability of working exploit code.
Cross-site scripting in aircheng-org iWebShop-5 through version 5.15 allows unauthenticated remote attackers to inject malicious JavaScript via the outerSrc and selectPhoto parameters of the uploadFile function in controllers/pic.php. Victim interaction is required to trigger script execution in the target's browser, resulting in limited integrity impact such as session hijacking or page defacement. A public proof-of-concept exists via a GitHub issue report; the project maintainer has not responded to the disclosure.
SQL injection in iWebShop-5 (versions 5.0-5.15) allows authenticated high-privilege users to manipulate database queries via the Search argument of the member_list function in controllers/member.php. The CVSS 4.0 vector (PR:H) confirms that administrative credentials are required, constraining the realistic attacker pool but not eliminating risk in multi-tenant or compromised-admin scenarios. A public exploit has been disclosed via a GitHub issue report, and the vendor has not responded to the responsible disclosure.
Unrestricted file upload in aircheng-org iWebShop-5 versions up to 5.15 allows remote unauthenticated attackers to upload arbitrary files - including PHP webshells - via the `upload_json` and `uploadFile` functions in `controllers/pic.php`. The CVSS 4.0 vector (AV:N/AC:L/AT:N/PR:N/UI:N) confirms zero-barrier network exploitation requiring no authentication or user interaction. A public proof-of-concept exploit has been disclosed via GitHub issue, and no vendor patch is available as the project has not responded to responsible disclosure.
Missing authorization in aircheng-org iWebShop-5 (all versions through 5.15) exposes the Update::index controller method in controllers/update.php to unauthenticated remote invocation, allowing any network-reachable attacker to trigger the application's update workflow without credentials. The CWE-862 flaw is confirmed by a public proof-of-concept filed in the project's GitHub issue tracker, and the vendor has not responded to disclosure. No CISA KEV listing exists, but active exploitation risk is elevated by the availability of working exploit code.