CVE-2026-112032: aircheng-org iWebShop-5 util.php search sql injection
A vulnerability was identified in aircheng-org iWebShop-5 up to 5.16. Impacted is the function Util::search of the file classes/util.php. The manipulation leads to sql injection. It is possible to initiate the attack remotely. The exploit is publicly available and might be used. The project was informed of the problem early through an issue report but has not responded yet.
Affected Software
Event History
Frequently Asked Questions
Which installations should be reviewed?
Deployments of aircheng-org iWebShop-5 through version 5.16 should be reviewed, as the affected Util::search function is in classes/util.php.
What access does an attacker need to exploit this issue?
The CVSS vector indicates high privileges are required. The attack can then be initiated remotely and does not require user interaction.
How likely is exploitation?
A public exploit is available and may be used. The reported impact includes low confidentiality, integrity, and availability effects.
Is a vendor fix available?
The available information does not identify a fixed version. The project was notified through an issue report but had not responded at the time of the report.