Executive brief
iWebShop-5 is a multi-vendor e-commerce platform written in PHP. A flaw in the seller login authentication allows administratively locked/disabled merchants to retain full access to the seller panel by exploiting SQL operator precedence. This defeats account lockouts used to prevent fraudulent or abusive sellers from accessing their accounts.
Technical details
The vulnerability is an authentication bypass (CWE-287) in the seller login function (controllers/systemseller.php). The root cause is improper SQL operator precedence: the query checks `seller_name = "..." OR mobile = "..." AND is_del = 0 AND is_lock = 0`, where the AND conditions bind only to the mobile branch due to operator precedence, allowing sellers with `is_lock = 1` to authenticate via username. Attack vector is network-based and requires valid seller credentials. An attacker with a locked seller account can POST to the login endpoint and gain full seller panel access. The fix requires rewriting the SQL predicate with explicit parentheses and/or PHP-level validation of the lock status after fetching the seller record.
Affected products
- aircheng-org iWebShop-5 up to 5.15
Timeline
- 2026-07-29: disclosed: Vulnerability reported via GitHub issue #6
- 2026-09-08: advisory: CVE-2026-86669 published on NVD
- 2026-09-08: other: Exploit is public; project has not responded to issue report