---
id: "CVE-2026-112032"
kind: "vulnerability"
aliases: ["CVE-2026-112032"]
title: "iWebShop-5: SQL injection in search utility lets remote users query the database"
severity: "medium"
cvss: 5.8
epss: null
exploited: false
status: "open"
category: "package"
products: []
ecosystems: []
tags: ["e-commerce", "iwebshop", "package", "php", "self-hosted"]
not_affected_if: ["unknown"]
published_at: "2026-10-19T00:16:31+00:00"
first_seen_at: "2026-10-23T21:57:17+00:00"
updated_at: "2026-10-25T04:10:21+00:00"
sources: [{"source": "nvd", "url": "https://nvd.nist.gov/vuln/detail/CVE-2026-112032", "first_seen_at": "2026-10-23T21:57:17+00:00"}]
---

# iWebShop-5: SQL injection in search utility lets remote users query the database

iWebShop-5 up to version 5.16 has an SQL injection flaw in the Util::search function in classes/util.php. A remote attacker can alter database queries through crafted input, which can expose or change stored shop data.

_Summary, check and fix written by a model from the sources; labelled as such._

## How to check

- Check the installed iWebShop version in the project's version file or admin panel and see whether it is `5.16` or earlier.
- Look at `classes/util.php` for the `Util::search` function and check whether user input is concatenated into SQL without parameter binding.

## Timeline

- 2026-10-23T21:57:17+00:00 nvd https://nvd.nist.gov/vuln/detail/CVE-2026-112032

## From the sources

A vulnerability was identified in aircheng-org iWebShop-5 up to 5.16. Impacted is the function Util::search of the file classes/util.php. The manipulation leads to sql injection. It is possible to initiate the attack remotely. The exploit is publicly available and might be used. The project was informed of the problem early through an issue report but has not responded yet.

---

_Free to read at a human pace. An API with keys and an MCP server are in preparation; early access: hello@infrastack.ai_