This vulnerability in aircheng-org iWebShop-5 up to version 5.15 allows remote attackers to exploit an SQL injection flaw by manipulating the Search parameter in the member_list function located in controllers/member.php. The issue was reported early to the project but remains unaddressed. The CVSS 4.0 base score is 5.1, indicating medium severity with network attack vector, low complexity, no privileges required, and no user interaction needed. Public exploit code exists but no known active exploitation has been reported.

Successful exploitation could allow an attacker to execute arbitrary SQL commands on the backend database remotely, potentially leading to unauthorized data access or modification. However, the CVSS indicates low impact on confidentiality, integrity, and availability, suggesting limited scope or partial control. No known active exploitation in the wild has been confirmed.

No official fix or patch is currently available from the vendor. Users should monitor the vendor's advisories for updates. Until a patch is released, consider applying temporary mitigations such as input validation or web application firewalls to detect and block SQL injection attempts targeting the Search parameter in member_list. Avoid exposing vulnerable endpoints to untrusted networks if possible.