This vulnerability affects aircheng-org iWebShop-5 versions 5.0 through 5.15. The flaw exists in the upload_json/uploadFile function of controllers/pic.php, which improperly restricts file uploads, enabling attackers to upload arbitrary files remotely. The vulnerability has a CVSS 4.0 base score of 6.9, indicating medium severity. Public exploit code is available, increasing the risk of exploitation. The vendor has not provided a patch or official remediation at this time.

Successful exploitation allows remote attackers to upload arbitrary files to the affected system, potentially leading to further compromise depending on the nature of the uploaded files. The vulnerability's medium severity reflects the potential for unauthorized file uploads without authentication or user interaction. No known active exploitation in the wild has been reported yet.

No official fix or patch is currently available from the vendor. Since the vendor has not responded to the issue report, users should apply compensating controls such as restricting access to the upload functionality, implementing web application firewalls to detect and block malicious uploads, or disabling the vulnerable upload feature if possible. Monitor vendor channels for updates or patches addressing this vulnerability.