Impact

The vulnerability allows for remote file upload, which is a precursor to full system compromise or web defacement. Because the exploit is publicly available, the risk of automated or targeted exploitation is elevated. Organizations hosting e-commerce platforms using the affected versions of iWebShop are highly susceptible to malicious file drops and subsequent code execution.

Recommendation

• Implement request filtering at the web application firewall (WAF) to inspect POST requests directed to /controllers/pic.php for suspicious file extensions or content types.
• Monitor web server access logs for anomalous requests to the uploadFile function.
• Disable the affected functionality or restrict access to the /controllers/pic.php endpoint to known administrative source IPs until a vendor patch is released.