This vulnerability in aircheng-org iWebShop-5 up to version 5.15 allows an attacker to perform improper authentication by manipulating the Name argument in the Login function located in controllers/systemseller.php. The issue can be exploited remotely without privileges or user interaction. The vulnerability was responsibly disclosed but remains unpatched as of the publication date. The CVSS 4.0 vector indicates network attack vector, low attack complexity, no privileges required, no user interaction, and low to low impact on confidentiality, integrity, and availability.

Successful exploitation allows an attacker to bypass authentication controls remotely, potentially gaining unauthorized access to the system. This could lead to unauthorized actions within the affected application context. However, the impact on confidentiality, integrity, and availability is rated low to low, consistent with the medium severity score.

No official fix or patch is currently available, and the vendor has not responded to the issue report. Users should monitor the vendor's communications for updates. Until a patch is released, consider implementing additional access controls or network-level restrictions to limit exposure of the vulnerable login functionality. Patch status is not yet confirmed — check the vendor advisory for current remediation guidance.