The flaw resides in the Login function of iWebShop-5’s systemseller controller. By manipulating the Name argument, an attacker can bypass authentication controls and obtain administrative access. The weakness is a classic example of improper authentication (CWE‑287). The impact is that an unauthenticated remote user could gain privileged credentials and execute any actions authorized to a legitimate seller, potentially compromising confidentiality, integrity, and availability of the shop’s data and operations.

The issue affects aircheng-org iWebShop‑5 versions up to 5.15. Any installation running 5.15 or older is vulnerable and should be considered for immediate review.

With a CVSS score of 6.9, the vulnerability represents a medium severity risk. No EPSS score is available, and the vulnerability is not listed in CISA KEV, suggesting no known widespread exploitation yet. However, the description confirms that the exploit is publicly available and can be triggered remotely via the web interface, indicating that the attack path is straightforward for attackers who can reach the affected service.