# CVE-2026-86667: aircheng-org iWebShop SQL injection in member_list

Source: https://junglewise.ai/threats/cve-2026-86667-aircheng-org-iwebshop-sql-injection-in-member-list  
Publisher: Junglewise Threat Intelligence, https://junglewise.ai/threats  
Published: 2026-09-08. Updated: 2026-09-26  
License: CC BY 4.0 with a link back

CVE-2026-86667 · Severity: medium · CVSS 4.7 · Published 2026-09-08

iWebShop is an open-source multi-vendor e-commerce platform used to build online marketplaces. An SQL injection vulnerability in the admin member list search function allows authenticated administrators to manipulate database queries and potentially extract or modify sensitive member data. While exploitation requires admin credentials, the vulnerability could be exploited through phishing or account compromise attacks.

Vendors: [Aircheng-Org](https://junglewise.ai/threats/vendors/aircheng-org).

## Quick answers

**Is CVE-2026-86667 exploited in the wild?** No. Junglewise Threat Intelligence has no report of CVE-2026-86667 being exploited in the wild.

**How severe is CVE-2026-86667?** Medium severity, with a CVSS score of 4.7, published 8 September 2026.

**Which products and versions are affected?** Aircheng-Org iWebShop up to 5.15.

**Is there a fix for CVE-2026-86667?** No fixed version is recorded yet. Check the vendor's advisory in the references below. If you run it, Junglewise drafts a mitigation that fits your setup and applies it once you approve, with senior security engineers behind it.

**How is CVE-2026-86667 attacked?** It is attacked over the network.

**Am I affected by CVE-2026-86667?** Check whether you run Aircheng-Org iWebShop at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

## Technical details

A SQL injection vulnerability exists in the member_list function of controllers/member.php where the search parameter is insufficiently validated before concatenation into a LIKE clause. The vulnerable code uses a loose "strict" filter that only checks for allowed characters but does not enforce a column name allowlist, allowing attackers to inject SQL logic operators and predicates. The attack requires authentication as an administrator and network access to the application. An authenticated attacker can craft malicious search parameters to break the query logic, extract unauthorized data from the member table, or manipulate query results. The root cause is the combination of insufficient input validation and direct string concatenation of user input into SQL statements instead of using parameterized queries. Patching requires implementing a concrete column name allowlist and converting keyword values to bound parameters.

## Affected products

- aircheng-org iWebShop up to 5.15

## Timeline

- 2026-07-29: disclosed: SQL injection vulnerability reported on GitHub
- 2026-09-08: advisory: CVE-2026-86667 published in NVD

## References

- [https://github.com/aircheng-org/iWebShop-5/](https://github.com/aircheng-org/iWebShop-5/)
- [https://github.com/aircheng-org/iWebShop-5/issues/5](https://github.com/aircheng-org/iWebShop-5/issues/5)

## Related threats

- [aircheng-org iWebShop SQL injection in Util::search](https://junglewise.ai/threats/cve-2026-112032-a-vulnerability-was-identified-in-aircheng-org-iwebshop-5-up-to)