Description

A vulnerability was identified in aircheng-org iWebShop-5 up to 5.15. This issue affects the function Update::index of the file controllers/update.php. The manipulation leads to missing authorization. Remote exploitation of the attack is possible. The exploit is publicly available and might be used. The project was informed of the problem early through an issue report but has not responded yet.

Executive Summary

Technical Details

Mitigations

References

Additional Metadata

{
  "score": "7.3",
  "pubDate": "2026-09-08T15:18:56.067Z",
  "pubdate": "2026-09-08T15:18:56.067Z",
  "executiveSummary": "A critical missing authorization vulnerability has been identified in iWebShop versions up to 5.15.\nThe vulnerability resides within the Update::index function located in controllers/update.php.\nThis flaw allows unauthenticated remote attackers to bypass access controls, potentially leading to unauthorized administrative actions or system manipulation.\nGiven that the exploit is publicly available and the vendor has remained unresponsive to disclosure attempts, the risk of active exploitation is significant.\nThe vulnerability allows for remote exploitation without prior authentication, posing a severe threat to the integrity and availability of affected iWebShop installations.\nAdministrators are urged to implement immediate compensatory controls to restrict access to the affected controller.",
  "technicalDetails": "The root cause of this vulnerability is an improper access control mechanism within the Update::index function, which fails to verify the authorization status or identity of the user before executing the update-related logic.\nThe vulnerability exists in controllers/update.php, where the application logic assumes that requests directed to this controller are implicitly authorized.\nAn unauthenticated attacker can invoke the Update::index method by crafting a direct HTTP request to the corresponding URI.\nBecause the controller lacks robust session validation or role-based access control (RBAC) checks, the application proceeds to execute sensitive functions associated with the update process.\nThe attack flow involves an attacker identifying the endpoint associated with controllers/update.php. By sending a crafted request to this endpoint, the attacker bypasses the intended authorization gate, permitting the execution of backend procedures intended only for authenticated administrative users.\nThe public availability of exploit code facilitates easy integration into automated attack frameworks, increasing the likelihood of widespread exploitation against exposed instances.\nThe post-exploitation impact is severe, potentially allowing an attacker to manipulate application states, trigger unauthorized system updates, or potentially leverage the update mechanism to facilitate further exploitation vectors within the server environment.\nThis issue highlights a failure in the secure development lifecycle regarding authorization enforcement on administrative endpoints.\nAs the application does not validate the security context of the user triggering the update mechanism, the vulnerability effectively grants remote code execution or state modification capabilities to any network-capable actor."
}