{"id":"CVE-2026-112032","kind":"vulnerability","aliases":["CVE-2026-112032"],"related":[],"title":"iWebShop-5: SQL injection in search utility lets remote users query the database","description":"A vulnerability was identified in aircheng-org iWebShop-5 up to 5.16. Impacted is the function Util::search of the file classes/util.php. The manipulation leads to sql injection. It is possible to initiate the attack remotely. The exploit is publicly available and might be used. The project was informed of the problem early through an issue report but has not responded yet.","summary":"iWebShop-5 up to version 5.16 has an SQL injection flaw in the Util::search function in classes/util.php. A remote attacker can alter database queries through crafted input, which can expose or change stored shop data.","severity":"medium","cvss":5.8,"epss":null,"exploited":false,"exploited_at":null,"products":[],"ecosystems":[],"tags":["e-commerce","iwebshop","package","php","self-hosted"],"not_affected_if":["unknown"],"how_to_check":"- Check the installed iWebShop version in the project's version file or admin panel and see whether it is `5.16` or earlier.\n- Look at `classes/util.php` for the `Util::search` function and check whether user input is concatenated into SQL without parameter binding.","fix":null,"status":"open","published_at":"2026-10-19T00:16:31+00:00","first_seen_at":"2026-10-23T21:57:17+00:00","triaged_at":"2026-10-25T04:10:21+00:00","updated_at":"2026-10-25T04:10:21+00:00","category":"package","confidence":0.6,"triage":{"at":"2026-10-25T04:10:21Z","model":"claude-haiku-5-5","output":{"fix":"unknown","reach":"internet","title":"iWebShop-5: SQL injection in search utility lets remote users query the database","impact":"medium","summary":"iWebShop-5 up to version 5.16 has an SQL injection flaw in the Util::search function in classes/util.php. A remote attacker can alter database queries through crafted input, which can expose or change stored shop data.","category":"package","nicknames":[],"who_cares":["iwebshop","php","self-hosted","e-commerce"],"confidence":0.6,"needs_auth":"unknown","worst_case":"Attacker reads or alters shop database contents through search input","analyst_note":"Confirm the fix status and whether any patched release exists; the project has not responded, so check the upstream repository and the NVD entry for a workaround.","how_to_check":"- Check the installed iWebShop version in the project's version file or admin panel and see whether it is `5.16` or earlier.\n- Look at `classes/util.php` for the `Util::search` function and check whether user input is concatenated into SQL without parameter binding.","needs_analyst":true,"not_affected_if":["unknown"],"who_is_affected":"Sites running iWebShop-5 at version 5.16 or earlier are exposed through the search path in classes/util.php. The sources do not say whether specific configurations change exposure. The project has not responded to the early report, so no patched version is confirmed.","user_interaction":"no","needs_special_setup":"unknown","severity_if_unknown":"medium"},"cost_usd":0.000587,"input_tokens":3327,"output_tokens":509,"severity_before":"medium"},"analyst_status":null,"analyst_note":null,"search":"'-112032':16A,19A '-2026':15A,18A '-5':2A,30B,74C '5.16':34B,77C 'aircheng':71C 'aircheng-org':70C 'alter':51B 'attack':49B,100C 'avail':106C 'chang':61B 'classes/util.php':46B,87C 'commerc':22B 'craft':55B 'cve':14A,17A 'data':64B 'databas':13A,52B 'e':21B 'e-commerc':20B 'earli':118C 'exploit':103C 'expos':59B 'file':86C 'flaw':39B 'function':44B,81C 'host':28B 'identifi':68C 'impact':78C 'inform':114C 'initi':98C 'inject':4A,38B,93C 'input':56B 'issu':121C 'iwebshop':1A,23B,29B,73C 'lead':90C 'let':8A 'manipul':89C 'might':108C 'org':72C 'packag':24B 'php':25B 'possibl':96C 'problem':117C 'project':112C 'public':105C 'queri':11A,53B 'remot':9A,48B,101C 'report':122C 'respond':126C 'search':6A,43B,83C 'self':27B 'self-host':26B 'shop':63B 'sql':3A,37B,92C 'store':62B 'use':110C 'user':10A 'util':7A,42B,82C 'version':33B 'vulner':66C 'yet':127C","nicknames":[],"mitigations":[],"who_affected":"Sites running iWebShop-5 at version 5.16 or earlier are exposed through the search path in classes/util.php. The sources do not say whether specific configurations change exposure. The project has not responded to the early report, so no patched version is confirmed.","tier":"C","verified":{},"analyst_revisit_at":null,"first_public_at":"2026-10-19T00:16:31+00:00","kev":null,"cvss_vector":"CVSS:4.0/AV:N/AC:L/AT:N/PR:H/UI:N/VC:L/VI:L/VA:L/SC:N/SI:N/SA:N/E:P/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","cvss_by":"cna@vuldb.com","poc_count":0,"sources":[{"source":"nvd","external_id":"CVE-2026-112032","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-112032","severity":null,"published_at":"2026-10-19T00:16:31+00:00","modified_at":"2026-10-19T17:17:08+00:00","first_seen_at":"2026-10-23T21:57:17+00:00","fetched_at":"2026-10-23T22:28:56+00:00","note":null}],"documents":[],"notice":"Free to read at a human pace. An API with keys and an MCP server are in preparation; early access: hello@infrastack.ai"}