CVE-2026-86667 Overview
CVE-2026-86667 is a SQL injection vulnerability affecting aircheng-org iWebShop-5 versions up to and including 5.15. The flaw resides in the member_list function within controllers/member.php, where the Search argument is passed to a database query without proper sanitization. A remote authenticated attacker with high privileges can manipulate the Search parameter to inject arbitrary SQL statements. Public exploit details are available, and the project maintainers have not responded to the issue report at the time of publication. The vulnerability is tracked under [CWE-74] (Improper Neutralization of Special Elements in Output Used by a Downstream Component).
Critical Impact
An authenticated remote attacker can inject SQL statements through the Search parameter of member_list, potentially exposing member data stored in the iWebShop-5 backend database.
Affected Products
- aircheng-org iWebShop-5 version 5.0 through 5.15
- Component: controllers/member.php
- Function: member_list (parameter Search)
Discovery Timeline
- 2026-09-08 - CVE-2026-86667 published to NVD
- 2026-09-08 - Last updated in NVD database
Technical Details for CVE-2026-86667
Vulnerability Analysis
The vulnerability exists in the member_list handler of controllers/member.php in iWebShop-5. The handler accepts a user-supplied Search argument and incorporates it into a SQL query without adequate escaping or parameterization. An attacker submits a crafted Search value that terminates the intended SQL context and appends attacker-controlled SQL fragments. The database then executes both the intended query and the injected payload. Because the vulnerable code path requires an authenticated session with elevated privileges, exploitation is limited to accounts that can already reach the member management interface. Reported impact spans limited confidentiality, integrity, and availability of the backing database.
Root Cause
The root cause is improper neutralization of special elements passed to the SQL interpreter, categorized under [CWE-74]. The Search parameter is concatenated into a query string rather than bound as a parameter. iWebShop-5 lacks a centralized input validation layer for administrative search functionality, allowing SQL metacharacters to flow directly into the query builder.
Attack Vector
Exploitation requires network access to the iWebShop-5 administrative interface and an authenticated session with sufficient privileges to invoke member_list. The attacker submits an HTTP request containing a manipulated Search parameter. No user interaction is required. The exploit has been made public, lowering the barrier to weaponization. Refer to the VulDB CVE-2026-86667 Entry and the GitHub iWebShop-5 Issue Tracker for reported technical details.
Detection Methods for CVE-2026-86667
Indicators of Compromise
- HTTP requests to the member_list endpoint containing SQL metacharacters such as single quotes, UNION, SELECT, --, or /* in the Search parameter.
- Web server access logs showing abnormally long or encoded Search values submitted by administrative accounts.
- Database error messages or unexpected result sets returned from queries originating in controllers/member.php.
Detection Strategies
- Deploy web application firewall rules that inspect the Search parameter on member management endpoints for SQL injection patterns.
- Enable verbose query logging on the MySQL or MariaDB backend and alert on queries containing UNION SELECT, INFORMATION_SCHEMA, or stacked statements originating from iWebShop-5.
- Correlate authenticated administrative sessions with anomalous outbound data volume or unusual query response times.
Monitoring Recommendations
- Baseline normal Search query patterns and alert on deviations in length, character class, or frequency.
- Monitor administrative account logins for geographic or time-of-day anomalies that could indicate credential compromise preceding exploitation.
- Forward web server, application, and database logs to a centralized analytics platform for cross-source correlation.
How to Mitigate CVE-2026-86667
Immediate Actions Required
- Restrict network access to the iWebShop-5 administrative interface using IP allowlisting or VPN gating.
- Rotate credentials for all privileged iWebShop-5 accounts and enforce strong password policies.
- Audit member management logs for evidence of prior Search parameter abuse.
- Consider taking the affected component offline until an upstream patch is available.
Patch Information
No vendor patch is available at the time of publication. The project maintainer was notified through an issue report but has not responded. Track the GitHub iWebShop-5 Repository and the GitHub iWebShop-5 Issue Tracker for updates.
Workarounds
- Apply a virtual patch at the web application firewall to reject Search parameters containing SQL metacharacters or exceeding a defined length.
- Modify controllers/member.php locally to use parameterized queries or prepared statements for the Search argument.
- Enforce least privilege on database accounts used by iWebShop-5 so that injected queries cannot access unrelated schemas.
- Disable the member_list endpoint for accounts that do not require it.
Disclaimer: This content was generated using AI. While we strive for accuracy, please verify critical information with official sources.
