CVE-2026-86667: aircheng-org iWebShop-5 member.php member_list sql injection
A weakness has been identified in aircheng-org iWebShop-5 up to 5.15. The affected element is the function memberlist of the file controllers/member.php. This manipulation of the argument Search causes sql injection. The attack is possible to be carried out remotely. The exploit has been made available to the public and could be used for attacks. The project was informed of the problem early through an issue report but has not responded yet.
Affected Software
Event History
Frequently Asked Questions
What level of access does an attacker need to exploit this issue?
The vulnerability requires high privileges (PR:H) but can be exploited remotely without user interaction. The vulnerable input is the Search argument handled by member_list in controllers/member.php.
Are public exploits available?
Yes. Public exploit information is available, and the exploitability assessment is rated as proof-of-concept (E:P).
Which releases are affected?
iWebShop-5 versions up to and including 5.15 are affected. No fixed version is identified in the available data.
What can be done if a patch is not available?
The available data does not identify a vendor fix or workaround. Restrict access to high-privilege functionality that can reach member_list and monitor requests involving the Search argument.