Executive brief
iWebShop-5 is an open-source e-commerce platform that stores user, admin, and seller passwords using unsalted MD5 hashing instead of modern algorithms. If a database is compromised through backup exposure, SQL injection, or misconfigured access, attackers can rapidly crack password hashes using online rainbow tables or GPU-accelerated tools, gaining immediate access to administrative and customer accounts. This substantially increases the damage from any data breach.
Technical details
The vulnerability is a weak cryptographic algorithm (CWE-327) in password storage across multiple components: admin login (controllers/admin.php), system password creation (controllers/system.php), seller login (controllers/systemseller.php), user registration and password reset (controllers/simple.php and plugins/_userInfo/_userInfo.php). All password hashes use unsalted MD5 with direct digest comparison during authentication, making them trivially reversible once database access is obtained. Attack requires network access to the database or a secondary vulnerability exposing stored credentials; no authentication is needed if database backup is accessed separately. Exploitation is straightforward using freely available MD5 rainbow tables. The project was informed via GitHub issue on 2026-07-29 but has not patched as of the advisory publication date.
Affected products
- aircheng-org iWebShop-5 up to 5.15
Timeline
- 2026-07-29: disclosed: Issue reported on GitHub
- 2026-09-08: advisory: Vulnerability advisory published