Executive brief
iWebShop-5 is an e-commerce platform used to run online marketplaces. An unauthenticated attacker can inject malicious JavaScript code through the file upload feature, which runs in the context of the shop's origin. This allows theft of administrative cookies and takeover of the e-commerce platform without any user interaction beyond visiting a crafted link.
Technical details
The vulnerability is a reflected cross-site scripting (XSS) flaw in the uploadFile function within controllers/pic.php. The vulnerable code accepts user-supplied input via the outerSrc or selectPhoto POST parameters and reflects them directly into an inline JavaScript snippet without encoding or sanitization. The endpoint requires no authentication. An attacker can inject JavaScript code that breaks out of the string context and executes arbitrary code in the browser, including stealing session cookies. The reported CVSS v3.1 score is 6.1 (Medium). The project has not yet responded to the disclosure, and no patch is currently available.
Affected products
- aircheng-org iWebShop-5 up to 5.15
Timeline
- 2026-07-29: disclosed: Vulnerability reported on GitHub issue #4
- 2026-09-08: advisory: CVE-2026-86668 published