Executive brief
iWebShop is an open-source multi-vendor e-commerce platform used to build online marketplaces. An SQL injection vulnerability in the admin member list search function allows authenticated administrators to manipulate database queries and potentially extract or modify sensitive member data. While exploitation requires admin credentials, the vulnerability could be exploited through phishing or account compromise attacks.
Technical details
A SQL injection vulnerability exists in the member_list function of controllers/member.php where the search parameter is insufficiently validated before concatenation into a LIKE clause. The vulnerable code uses a loose "strict" filter that only checks for allowed characters but does not enforce a column name allowlist, allowing attackers to inject SQL logic operators and predicates. The attack requires authentication as an administrator and network access to the application. An authenticated attacker can craft malicious search parameters to break the query logic, extract unauthorized data from the member table, or manipulate query results. The root cause is the combination of insufficient input validation and direct string concatenation of user input into SQL statements instead of using parameterized queries. Patching requires implementing a concrete column name allowlist and converting keyword values to bound parameters.
Affected products
- aircheng-org iWebShop up to 5.15
Timeline
- 2026-07-29: disclosed: SQL injection vulnerability reported on GitHub
- 2026-09-08: advisory: CVE-2026-86667 published in NVD