Executive brief
iWebShop is a PHP-based B2B2C e-commerce platform used to build online marketplaces. An unauthenticated attacker can remotely trigger database schema modifications and clear the application cache by accessing an upgrade controller without logging in, potentially corrupting the database and causing service outages.
Technical details
The vulnerability is a missing authorization check (CWE-862) in the Update controller (controllers/update.php), specifically the index() method. The Update class does not implement any authorization interface, causing the framework to treat all actions as public. An attacker can send a simple HTTP GET request to /index.php?controller=update&action=index to trigger SQL ALTER TABLE statements and delete the runtime cache directory as the web server user. No authentication or user interaction is required; the attack is entirely remote and unauthenticated. The exploit is publicly available and the issue was reported early but remains unpatched.
Affected products
- aircheng-org iWebShop-5 up to 5.15
Timeline
- 2026-07-29: disclosed: Vulnerability reported via GitHub issue
- 2026-09-08: advisory: CVE-2026-86665 published on NVD