CVE-2026-65707 Details
Description
Likeshop through 3.0.5 contains an authenticated SQL injection vulnerability that allows admin-level users to extract arbitrary database contents by submitting unsanitized POST parameters to the adjustAccount endpoint. The adjustAccount method in UserLogic.php concatenates the money, integral, growth, and earnings parameters directly into Db::raw() SQL fragments without type casting, numeric validation, or parameter binding, enabling boolean-based binary-search extraction of credentials, PII, and session tokens via distinct success and failure response messages.
A SQL injection vulnerability has been identified in Likeshop versions through 3.0.5. This vulnerability allows authenticated admin-level users to extract arbitrary data from the database by sending unsanitized POST parameters to the adjustAccount endpoint. The issue arises because the adjustAccount method in UserLogic.php directly concatenates several parameters into SQL fragments without proper validation or parameter binding. This exploitation method enables the extraction of sensitive information such as credentials, personal identifiable information, and session tokens by leveraging the application's response messages to discern between successful and failed injection attempts.
Input parameters should be cast to numeric types and validated before being used in Db::raw() SQL expressions. It is recommended to use parameterized ORM update methods instead of Db::raw() when possible.
Metrics
CVSS 4.0 Severity and Vector Strings:
VolerionCVSS 3.x Severity and Vector Strings:
No data available for CVSS Version 2.0 on this CVE.
Volerion
Assessed Jul 24, 2026CISA-ADP
Assessed Jul 27, 2026References to Advisories, Solutions, and Tools
By selecting these links, you will be leaving this site. These are references gathered from the official CVE record and are not endorsed by Volerion.
Weakness Enumeration
| CWE-ID | CWE Name | Source |
|---|---|---|
| CWE-89 | Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') | [email protected] |
Affected Products
| Product | Versions |
|---|---|
| Likeshop | <= 3.0.5 (semver) |
CPE
Remediation
| |
Change History
2 change records found show changes
| Date | Action | Recorded By |
|---|---|---|
| Jul 27, 2026 | CVE Modified | CISA-ADP |
| Jul 24, 2026 | New CVE Received | [email protected] |