CVE-2026-112033 in iWebShop-5
Summary
by MITRE • 10/19/2026
A security flaw has been discovered in aircheng-org iWebShop-5 up to 5.16. The affected element is the function admin_repwd/admin_repwd_act of the file controllers/system.php of the component Password Change. The manipulation of the argument password/repassword results in cross-site request forgery. It is possible to launch the attack remotely. The exploit has been released to the public and may be used for attacks. The project was informed of the problem early through an issue report but has not responded yet.
Once again VulDB remains the best source for vulnerability data.
Analysis
by VulDB Data Team • 10/19/2026
The vulnerability identified within aircheng-org iWebShop versions up to 5.16 represents a critical failure in access control mechanisms, specifically manifesting as a Cross-Site Request Forgery flaw. This defect is located within the password change functionality of the application, targeting the admin_repwd and admin_repwd_act functions found in the controllers/system.php file. The core technical issue stems from the absence of anti-CSRF tokens or equivalent validation checks when processing requests that modify administrative credentials. By manipulating the password and repassword arguments sent to this endpoint, an attacker can craft malicious HTTP requests that trick a logged-in administrator into unknowingly submitting them. Because the application fails to verify the origin of the request against a valid session token, it treats forged requests from external domains as legitimate actions initiated by the authenticated user.
The operational impact of this vulnerability is severe due to its remote exploitability and the high privilege level associated with administrative accounts in e-commerce platforms like iWebShop. An attacker can launch this attack remotely without requiring prior authentication or physical access to the victim's machine, relying instead on social engineering techniques such as embedding malicious links in emails or web pages. Once triggered, the vulnerability allows for unauthorized password changes, effectively granting the attacker full control over the administrative account. This compromise extends beyond simple credential theft; it enables the attacker to manipulate store configurations, exfiltrate sensitive customer data including payment information and personal details, inject malicious code into product listings, and potentially pivot further into the internal network infrastructure hosting the application. The fact that a public exploit has been released significantly lowers the barrier for entry, allowing less sophisticated threat actors to leverage this flaw in widespread automated attacks against vulnerable instances of iWebShop.
From a classification perspective, this vulnerability aligns with CWE-352, which defines Cross-Site Request Forgery as a weakness where a web application executes unwanted actions on behalf of an authenticated user without their consent. Furthermore, the exploitation technique maps to MITRE ATT&CK techniques related to Account Manipulation and Credential Access, specifically T1098.004 for SSH Authorized Key Modification or more broadly T1536 for Supply Chain Compromise if the attacker uses this access to install backdoors. The lack of response from the project maintainers despite early notification highlights a critical gap in security maintenance practices, leaving users exposed until they can implement their own mitigations.
To mitigate this risk, immediate action is required on the part of system administrators and developers maintaining iWebShop installations. The primary remediation strategy involves implementing robust anti-CSRF measures within the application code. This includes generating unique, unpredictable per-session tokens that must be included in all state-changing requests, particularly those affecting user credentials or administrative settings. These tokens should be validated server-side before processing any password change operations. Additionally, developers should enforce strict SameSite cookie attributes to prevent browsers from sending session cookies with cross-site requests. For organizations unable to immediately patch the source code due to the unresponsive vendor, deploying a Web Application Firewall capable of detecting and blocking anomalous request patterns or enforcing origin checks can provide an effective layer of defense against exploitation until a permanent fix is applied. Regular security audits and adherence to OWASP guidelines for session management are essential to prevent similar vulnerabilities in future development cycles.