The flaw exists in the Update::index function of iWebShop-5’s update.php controller. An attacker can manipulate the endpoint to bypass required authorization checks, enabling unauthorized execution of update logic that may alter application state or deploy code. The vulnerability is classified as a missing authorization weakness (CWE-862) with an additional context‑injection issue (CWE-863). As a result, compromised systems could experience a loss of confidentiality, integrity, or availability, and the impact could be similar to remote code execution. The CVSS score of 6.9 indicates moderate severity, but the lack of a restrictive access control check means that exploitation is possible from a remote network location.

All instances of aircheng-org iWebShop-5 up to version 5.15 are vulnerable. The affected component is the Update::index function within the controllers/update.php file. The product is hosted on web servers that expose this endpoint without authentication.

The CVSS score of 6.9 and the EPSS information being unavailable suggest that while the likelihood of exploitation is uncertain, the attack vector is remote via HTTP requests to the update endpoint. The vulnerability is not listed in the CISA KEV catalog, but the public availability of an exploit makes the risk tangible for exposed installations. Attackers only need knowledge of the endpoint and the ability to send crafted requests; no additional privileges are required beyond network access to the web application.