{"id":"CVE-2026-112033","kind":"vulnerability","aliases":["CVE-2026-112033"],"related":[],"title":"iWebShop-5: password change form accepts cross-site forged requests","description":"A security flaw has been discovered in aircheng-org iWebShop-5 up to 5.16. The affected element is the function admin_repwd/admin_repwd_act of the file controllers/system.php of the component Password Change. The manipulation of the argument password/repassword results in cross-site request forgery. It is possible to launch the attack remotely. The exploit has been released to the public and may be used for attacks. The project was informed of the problem early through an issue report but has not responded yet.","summary":"The admin password change function in iWebShop-5 up to version 5.16 does not protect against cross-site request forgery. A malicious web page can make a logged-in administrator's browser submit a password change.","severity":"medium","cvss":5.0,"epss":null,"exploited":false,"exploited_at":null,"products":[],"ecosystems":[],"tags":["e-commerce","iwebshop","other","php","self-hosted"],"not_affected_if":["newer-version","no-admin-login-in-browser"],"how_to_check":"- Check the installed iWebShop-5 version; the sources say versions up to 5.16 are affected.\n- Look at controllers/system.php for the admin_repwd and admin_repwd_act functions and whether they verify a CSRF token.","fix":null,"status":"open","published_at":"2026-10-19T01:16:36+00:00","first_seen_at":"2026-10-23T21:57:17+00:00","triaged_at":"2026-10-25T04:30:53+00:00","updated_at":"2026-10-25T04:30:53+00:00","category":"other","confidence":0.6,"triage":{"at":"2026-10-25T04:30:53Z","model":"claude-haiku-5-5","output":{"fix":"unknown","reach":"internet","title":"iWebShop-5: password change form accepts cross-site forged requests","impact":"medium","summary":"The admin password change function in iWebShop-5 up to version 5.16 does not protect against cross-site request forgery. A malicious web page can make a logged-in administrator's browser submit a password change.","category":"other","nicknames":[],"who_cares":["iwebshop","php","self-hosted","e-commerce"],"confidence":0.6,"needs_auth":"yes","worst_case":"attacker changes an admin password through a forged request","analyst_note":"Confirm the fixed version or mitigation and whether the exploit is public; check the iWebShop project issue tracker and the CVE record.","how_to_check":"- Check the installed iWebShop-5 version; the sources say versions up to 5.16 are affected.\n- Look at controllers/system.php for the admin_repwd and admin_repwd_act functions and whether they verify a CSRF token.","needs_analyst":true,"not_affected_if":["newer-version","no-admin-login-in-browser"],"who_is_affected":"Sites running iWebShop-5 up to 5.16 with an admin account that can be reached in a browser. The sources do not say whether a patch exists; the project has not responded to the report.","user_interaction":"yes","needs_special_setup":"unknown","severity_if_unknown":"medium"},"cost_usd":0.000575,"input_tokens":3364,"output_tokens":478,"severity_before":"medium"},"analyst_status":null,"analyst_note":null,"search":"'-112033':14A,17A '-2026':13A,16A '-5':2A,34B,76C '5.16':38B,79C 'accept':6A 'admin':28B,86C 'administr':58B 'affect':81C 'aircheng':73C 'aircheng-org':72C 'argument':101C 'attack':116C,131C 'browser':60B 'chang':4A,30B,64B,96C 'commerc':20B 'compon':94C 'controllers/system.php':91C 'cross':8A,44B,106C 'cross-sit':7A,43B,105C 'cve':12A,15A 'discov':70C 'e':19B 'e-commerc':18B 'earli':139C 'element':82C 'exploit':119C 'file':90C 'flaw':67C 'forg':10A 'forgeri':47B,109C 'form':5A 'function':31B,85C 'host':26B 'inform':135C 'issu':142C 'iwebshop':1A,21B,33B,75C 'launch':114C 'log':56B 'logged-in':55B 'make':53B 'malici':49B 'manipul':98C 'may':127C 'org':74C 'page':51B 'password':3A,29B,63B,95C 'password/repassword':102C 'php':23B 'possibl':112C 'problem':138C 'project':133C 'protect':41B 'public':125C 'releas':122C 'remot':117C 'report':143C 'repwd/admin_repwd_act':87C 'request':11A,46B,108C 'respond':147C 'result':103C 'secur':66C 'self':25B 'self-host':24B 'site':9A,45B,107C 'submit':61B 'use':129C 'version':37B 'web':50B 'yet':148C","nicknames":[],"mitigations":[],"who_affected":"Sites running iWebShop-5 up to 5.16 with an admin account that can be reached in a browser. The sources do not say whether a patch exists; the project has not responded to the report.","tier":"C","verified":{},"analyst_revisit_at":null,"first_public_at":"2026-10-19T01:16:36+00:00","kev":null,"cvss_vector":"CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:P/VC:N/VI:L/VA:N/SC:N/SI:N/SA:N/E:P/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","cvss_by":"cna@vuldb.com","poc_count":0,"sources":[{"source":"nvd","external_id":"CVE-2026-112033","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-112033","severity":null,"published_at":"2026-10-19T01:16:36+00:00","modified_at":"2026-10-19T18:17:01+00:00","first_seen_at":"2026-10-23T21:57:17+00:00","fetched_at":"2026-10-23T22:28:56+00:00","note":null}],"documents":[],"notice":"Free to read at a human pace. An API with keys and an MCP server are in preparation; early access: hello@infrastack.ai"}