The vulnerability resides in the Util::search function within classes/util.php in aircheng-org iWebShop-5 up to version 5.16. Manipulating this function causes an SQL injection that can be triggered remotely, allowing an attacker to read, modify or delete data from the underlying database. The flaw is a combination of improper input validation (CWE-74) and the use of unsanitized SQL statements (CWE-89).

Vendors aircheng-org, product iWebShop-5, affecting all releases up to and including 5.16. The vulnerability is present wherever the Util::search function is publicly exposed via the web interface.

The CVSS score of 5.1 indicates a medium severity flaw. EPSS is not available, but the flaw is publicly disclosed and the exploit exists, so manual exploitation is feasible. No KEV listing reduces official alerting, yet the remote nature and lack of authentication on the search endpoint increase risk. The primary attack vector is a remote web request to the search functionality. It is not stated explicitly whether credentials are required, but the description implies that the endpoint may be publicly accessible, so exploitation could potentially occur from any network.