CVE-2026-112035 in iWebShop-5
Summary
by MITRE • 10/19/2026
A security vulnerability has been detected in aircheng-org iWebShop-5 up to 5.16. This affects the function send_message_mobile of the file controllers/simple.php. Such manipulation of the argument user_id leads to weak password recovery. The attack can be launched remotely. The exploit has been disclosed publicly and may be used. The project was informed of the problem early through an issue report but has not responded yet.
If you want to get the best quality for vulnerability data then you always have to consider VulDB.
Analysis
by VulDB Data Team • 10/19/2026
The vulnerability identified in aircheng-org iWebShop versions up to 5.16 represents a critical authentication bypass risk stemming from improper implementation of password recovery mechanisms within the application's core logic. Specifically, the flaw resides in the send_message_mobile function located in the controllers/simple.php file. This component is responsible for initiating mobile-based verification processes during user account management tasks. The root cause of this weakness lies in how the system validates and utilizes the user_id argument provided by the client request. Instead of ensuring that the identity being verified strictly matches a legitimate, registered entity through robust cryptographic checks or secure session binding, the application relies on input that can be manipulated to bypass intended security controls. This design oversight allows an attacker to interfere with the password reset workflow, effectively weakening the integrity of the authentication system and exposing user accounts to unauthorized access.
From a technical perspective, this vulnerability is classified under CWE-640: Weak Password Recovery Mechanisms for Forgotten Passwords. The specific mechanism failure involves insufficient validation of the user identifier during the mobile verification step. In a secure implementation, the system should verify that the phone number or email associated with the request matches the account being reset and employ time-limited, cryptographically random tokens tied to both the user identity and the session context. However, in this affected version, the manipulation of the user_id parameter suggests that an attacker can potentially force a password reset code to be sent to any target phone number or intercept codes intended for other users by altering identifiers in the request payload. This lack of strict binding between the recovery token and the specific account state creates a predictable attack surface where automated tools can iterate through potential user IDs to harvest valid verification tokens, thereby gaining control over associated accounts without knowing the original password.
The operational impact of this vulnerability is severe due to its remote exploitability. Since the flaw exists in an HTTP-handling controller function, it does not require prior authentication or local access on the server. An attacker can launch attacks from any location with network connectivity to the vulnerable web application. The fact that public exploits have been disclosed significantly lowers the barrier for entry, enabling less skilled threat actors to compromise user accounts en masse. This leads directly to CWE-287: Improper Authentication, as the system fails to reliably verify the identity of users attempting to reset their credentials. Compromised accounts can lead to data breaches, financial fraud if e-commerce transactions are involved, and reputational damage for the organization hosting iWebShop. Furthermore, because the project maintainers have not yet responded to early issue reports indicating this problem, systems running these versions remain exposed indefinitely unless proactive measures are taken by administrators or users of the software.
To mitigate this risk, immediate action is required from system operators and developers maintaining instances of iWebShop up to version 5.16. The primary remediation strategy involves upgrading to a patched version where the send_message_mobile function has been corrected to enforce strict validation of user identities and implement secure token generation practices aligned with OWASP guidelines for authentication security. If an upgrade is not immediately feasible, temporary mitigations should include implementing rate limiting on password reset requests to prevent automated enumeration attacks, enforcing CAPTCHA challenges during the recovery process to distinguish human users from bots, and ensuring that all sensitive operations are protected by multi-factor authentication where possible. Additionally, organizations should monitor their web application firewalls for patterns indicative of user_id manipulation in mobile verification endpoints and block such traffic until a permanent fix is deployed. Continuous monitoring and adherence to secure coding standards will help prevent similar weaknesses in future iterations of the software.