CVE-2026-65707
Likeshop 3.0.5 Authenticated SQL Injection via adjustAccount Endpoint
CVSS Score
6.5
EPSS Score
0.0%
EPSS Percentile
0th
Likeshop through 3.0.5 contains an authenticated SQL injection vulnerability that allows admin-level users to extract arbitrary database contents by submitting unsanitized POST parameters to the adjustAccount endpoint. The adjustAccount method in UserLogic.php concatenates the money, integral, growth, and earnings parameters directly into Db::raw() SQL fragments without type casting, numeric validation, or parameter binding, enabling boolean-based binary-search extraction of credentials, PII, and session tokens via distinct success and failure response messages.
| CWE | CWE-89 |
| Vendor | likeadmin-likeshop |
| Product | likeshop |
| Published | Jul 24, 2026 |
Stay Ahead of the Next One
Get instant alerts for likeadmin-likeshop likeshop
Be the first to know when new medium vulnerabilities affecting likeadmin-likeshop likeshop are published — delivered to Slack, Telegram or Discord.
Get Free Alerts →
Free · No credit card · 60 sec setup
CVSS v3 Breakdown
CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:N Attack Vector
Network
Attack Complexity
Low
Privileges Required
High
User Interaction
None
Scope
Unchanged
Confidentiality
High
Integrity
High
Availability
None
Affected Versions
likeadmin-likeshop / likeshop
0 ≤ 3.0.5
References
Credits
Peoz