CVE-2026-112033: Cross-Site Request Forgery in aircheng-org iWebShop-5

This vulnerability in aircheng-org iWebShop-5 up to version 5.16 involves a CSRF issue in the password change component. Specifically, the admin_repwd and admin_repwd_act functions in controllers/system.php improperly handle the password and repassword arguments, enabling attackers to perform unauthorized password changes remotely. The vulnerability has a CVSS 4.0 base score of 5.3 (medium severity) and was publicly disclosed with exploit code available. The vendor has not yet responded or provided a fix.

An attacker can remotely exploit this vulnerability to perform unauthorized password changes via CSRF attacks, potentially compromising administrative accounts. This could lead to unauthorized access or account takeover if successful. The impact is limited to the password change functionality and requires user interaction (UI:P) but no privileges or user authentication (PR:N).

No official patch or vendor advisory is currently available. Since the vendor has not responded or issued a fix, users should implement CSRF protections such as validating anti-CSRF tokens on password change requests or restricting access to the affected functionality. Monitoring for suspicious password change activity is recommended until an official fix is released. Patch status is not yet confirmed — check the vendor advisory for current remediation guidance.