In my web app (everything works with HTTPS), I send the user an SMS with a unique 5-digit code to a cellphone number he provides. I then ask the user to enter in the browser the code he received. Apart from the pure luck of guessing the 5 digits, is it 100% secure or is there a way to temper with this method?
I'm going to say no. While SMS is a generally accepted 2nd factor, there have been a number of cases where an attacker has used social engineering to break into a user's carrier account and pick up the verification code and use it. So to answer your question, is it 100% secure aside from guessing, no.
It's a public, insecure channel and should be treated as such. Adding come kind of SMS verification is better than nothing, but there are risks that may not be acceptable in the context of your application. If we are talking about authentication there are much better methods.
It offers a certain level of security but is as secure as your Carrier's customer service. E.g. one can know some basic info about you such as address, mother maiden name etc... call the carrier, transfer the number and hijack whatever the intent was...
About 4 months ago there was a wave of popular internet personal (and their mobile phone operators) getting socially engineered into blocking and reissuing their SIM cards to third party. From there, with the 2-step verification sending SMS to their phones, the bad guys managed to alter other people's social media and other accounts.