Executive brief
iWebShop-5 is an e-commerce platform built on PHP and MySQL that powers online marketplaces. An attacker can upload arbitrary files—including executable code—to the server without authentication through exposed image upload endpoints. This allows an attacker to store malicious files on the server and potentially execute code, enabling account takeover, data theft, or complete system compromise.
Technical details
The vulnerability is an unrestricted file upload (CWE-434) affecting the upload_json and uploadFile functions in controllers/pic.php. The pic controller is publicly accessible and lacks authentication checks. The underlying upload class permits non-image file types (ZIP, SWF, etc.) and uses a broken hex-scanning pattern in filter_class.php that fails to detect PHP short tags (<?=) and null bytes. An unauthenticated remote attacker can upload malicious files by sending a POST request to /index.php?controller=pic&action=upload_json or uploadFile. Uploaded files are stored in a web-accessible directory (/upload/detail/) allowing direct execution or inclusion. Combined with web server configuration or local file inclusion flaws, this enables remote code execution.
Affected products
- aircheng-org iWebShop-5 up to 5.15
Timeline
- 2026-07-29: disclosed: Issue reported on GitHub
- 2026-09-08: advisory: CVE-2026-86666 published