{"id":"CVE-2026-112034","kind":"vulnerability","aliases":["CVE-2026-112034"],"related":[],"title":"iWebShop-5: login redirect parameter enables open redirect to attacker sites","description":"A weakness has been identified in aircheng-org iWebShop-5 up to 5.16. The impacted element is the function IController::redirect of the file plugins/_userInfo/_userInfo.php of the component Login Redirect. This manipulation of the argument callback causes open redirect. The attack can be initiated remotely. The exploit has been made available to the public and could be used for attacks. The project was informed of the problem early through an issue report but has not responded yet.","summary":"iWebShop-5 up to version 5.16 passes the callback argument of the login redirect in plugins/_userInfo/_userInfo.php straight into IController::redirect without checking it. An attacker can craft a link that sends a user from the shop's login flow to any external site, which supports phishing.","severity":"medium","cvss":5.0,"epss":null,"exploited":false,"exploited_at":null,"products":[],"ecosystems":[],"tags":["e-commerce","iwebshop","package","php","self-hosted"],"not_affected_if":["default-config"],"how_to_check":"- Look for `plugins/_userInfo/_userInfo.php` in the iWebShop-5 install and check whether it calls `IController::redirect` with the `callback` request value\n- Confirm the installed version with the project's version file; versions up to `5.16` are affected","fix":null,"status":"open","published_at":"2026-10-19T01:16:37+00:00","first_seen_at":"2026-10-23T21:57:17+00:00","triaged_at":"2026-10-25T04:30:53+00:00","updated_at":"2026-10-25T04:30:53+00:00","category":"package","confidence":0.6,"triage":{"at":"2026-10-25T04:30:53Z","model":"claude-haiku-5-5","output":{"fix":"unknown","reach":"internet","title":"iWebShop-5: login redirect parameter enables open redirect to attacker sites","impact":"low","summary":"iWebShop-5 up to version 5.16 passes the callback argument of the login redirect in plugins/_userInfo/_userInfo.php straight into IController::redirect without checking it. An attacker can craft a link that sends a user from the shop's login flow to any external site, which supports phishing.","category":"package","nicknames":[],"who_cares":["iwebshop","php","e-commerce","self-hosted"],"confidence":0.6,"needs_auth":"no","worst_case":"users are redirected to attacker-controlled sites for phishing","analyst_note":"Check the upstream iWebShop-5 repository for a patched version after 5.16 and whether the plugin ships enabled by default; the source reports no vendor response.","how_to_check":"- Look for `plugins/_userInfo/_userInfo.php` in the iWebShop-5 install and check whether it calls `IController::redirect` with the `callback` request value\n- Confirm the installed version with the project's version file; versions up to `5.16` are affected","needs_analyst":true,"not_affected_if":["default-config"],"who_is_affected":"Sites running iWebShop-5 up to 5.16 with the Login Redirect plugin (_userInfo) present and reachable. The flaw only redirects, so it does not expose data or run code on the server. Sites on newer versions or without this plugin are not affected.","user_interaction":"yes","needs_special_setup":"unknown","severity_if_unknown":"medium"},"cost_usd":0.000611,"input_tokens":3356,"output_tokens":550,"severity_before":"medium"},"analyst_status":null,"analyst_note":null,"search":"'-112034':14A,17A '-2026':13A,16A '-5':2A,28B,83C '5.16':32B,86C 'aircheng':80C 'aircheng-org':79C 'argument':36B,108C 'attack':10A,51B,114C,133C 'avail':124C 'callback':35B,109C 'caus':110C 'check':48B 'commerc':20B 'compon':101C 'could':129C 'craft':53B 'cve':12A,15A 'e':19B 'e-commerc':18B 'earli':141C 'element':89C 'enabl':6A 'exploit':120C 'extern':68B 'file':97C 'flow':65B 'function':92C 'host':26B 'icontrol':45B,93C 'identifi':77C 'impact':88C 'inform':137C 'initi':117C 'issu':144C 'iwebshop':1A,21B,27B,82C 'link':55B 'login':3A,39B,64B,102C 'made':123C 'manipul':105C 'open':7A,111C 'org':81C 'packag':22B 'paramet':5A 'pass':33B 'phish':72B 'php':23B 'plugins/_userinfo/_userinfo.php':42B,98C 'problem':140C 'project':135C 'public':127C 'redirect':4A,8A,40B,46B,94C,103C,112C 'remot':118C 'report':145C 'respond':149C 'self':25B 'self-host':24B 'send':57B 'shop':62B 'site':11A,69B 'straight':43B 'support':71B 'use':131C 'user':59B 'version':31B 'weak':74C 'without':47B 'yet':150C","nicknames":[],"mitigations":[],"who_affected":"Sites running iWebShop-5 up to 5.16 with the Login Redirect plugin (_userInfo) present and reachable. The flaw only redirects, so it does not expose data or run code on the server. Sites on newer versions or without this plugin are not affected.","tier":"C","verified":{},"analyst_revisit_at":null,"first_public_at":"2026-10-19T01:16:37+00:00","kev":null,"cvss_vector":"CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:P/VC:N/VI:L/VA:N/SC:N/SI:N/SA:N/E:P/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","cvss_by":"cna@vuldb.com","poc_count":0,"sources":[{"source":"nvd","external_id":"CVE-2026-112034","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-112034","severity":null,"published_at":"2026-10-19T01:16:37+00:00","modified_at":"2026-10-22T03:16:33+00:00","first_seen_at":"2026-10-23T21:57:17+00:00","fetched_at":"2026-10-23T22:28:56+00:00","note":null}],"documents":[],"notice":"Free to read at a human pace. An API with keys and an MCP server are in preparation; early access: hello@infrastack.ai"}