The vulnerability in aircheng-org iWebShop-5 up to version 5.15 is a cross-site scripting (XSS) flaw located in the uploadFile function within controllers/pic.php. It results from improper handling of the outerSrc/selectPhoto argument, enabling remote attackers to execute arbitrary scripts in the context of the affected web application. The issue was reported early to the project but remains unaddressed, and public exploit details exist. No official remediation or patch has been published as of the data provided.

Successful exploitation allows an attacker to perform cross-site scripting attacks, potentially leading to the execution of arbitrary scripts in the victim's browser. This can result in session hijacking, defacement, or other malicious actions within the context of the affected web application. The vulnerability is remotely exploitable without authentication and requires user interaction (UI:P).

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Since the vendor has not responded or released a fix, users should consider applying temporary mitigations such as input validation or sanitization on the affected parameters, or restricting access to the vulnerable functionality until an official patch is available.