# CVE-2026-112032: aircheng-org iWebShop SQL injection in Util::search

Source: https://junglewise.ai/threats/cve-2026-112032-a-vulnerability-was-identified-in-aircheng-org-iwebshop-5-up-to  
Publisher: Junglewise Threat Intelligence, https://junglewise.ai/threats  
Published: 2026-10-19. Updated: 2026-10-19  
License: CC BY 4.0 with a link back

CVE-2026-112032 · Severity: medium · CVSS 4.7 · Published 2026-10-19

iWebShop is a PHP-based e-commerce platform used to run multi-vendor marketplaces. A SQL injection vulnerability in the search utility allows authenticated administrators or sellers to bypass filters and extract or modify sensitive database records by crafting malicious search parameters.

Vendors: [Aircheng-Org](https://junglewise.ai/threats/vendors/aircheng-org).

## Quick answers

**Is CVE-2026-112032 exploited in the wild?** No. Junglewise Threat Intelligence has no report of CVE-2026-112032 being exploited in the wild.

**How severe is CVE-2026-112032?** Medium severity, with a CVSS score of 4.7, published 19 October 2026.

**Which products and versions are affected?** Aircheng-Org iWebShop up to 5.16.

**Is there a fix for CVE-2026-112032?** No fixed version is recorded yet. Check the vendor's advisory in the references below. If you run it, Junglewise drafts a mitigation that fits your setup and applies it once you approve, with senior security engineers behind it.

**How is CVE-2026-112032 attacked?** It is attacked over the network, in a web application.

**Am I affected by CVE-2026-112032?** Check whether you run Aircheng-Org iWebShop at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

## Technical details

The Util::search function in classes/util.php concatenates unsanitized request parameters directly into SQL WHERE clauses without parameterization or column whitelisting. An attacker with admin or seller privileges can inject SQL operators and column names through search[id], search[like], and search[likeValue] parameters to rewrite queries and exfiltrate arbitrary data. Network attack vector is feasible when combined with XSS or CSRF against privileged users.

## Affected products

- aircheng-org iWebShop up to 5.16

## Timeline

- 2026-09-30: disclosed: SQL injection issue reported via GitHub issue #8
- 2026-10-19: advisory

## References

- [https://github.com/aircheng-org/iWebShop-5/](https://github.com/aircheng-org/iWebShop-5/)
- [https://github.com/aircheng-org/iWebShop-5/issues/8](https://github.com/aircheng-org/iWebShop-5/issues/8)

## Related threats

- [aircheng-org iWebShop SQL injection in member_list](https://junglewise.ai/threats/cve-2026-86667-aircheng-org-iwebshop-sql-injection-in-member-list)