Medium severity · published Jul 24, 2026
CVE-2026-65707
Likeshop 3.0.5 Authenticated SQL Injection via adjustAccount Endpoint
6.5
CVSS
0.5%
EPSS
No
On KEV
Description
Likeshop through 3.0.5 contains an authenticated SQL injection vulnerability that allows admin-level users to extract arbitrary database contents by submitting unsanitized POST parameters to the adjustAccount endpoint. The adjustAccount method in UserLogic.php concatenates the money, integral, growth, and earnings parameters directly into Db::raw() SQL fragments without type casting, numeric validation, or parameter binding, enabling boolean-based binary-search extraction of credentials, PII, and session tokens via distinct success and failure response messages.
CVSS vector
CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:N
Attack vector
Network
Complexity
Low
Privileges
High
User interaction
None
Confidentiality
High
Integrity
High
Availability
None
Scope
Unchanged
Exploitation
Is it being used?
Exploit prediction (EPSS)0.5% · higher than 40% of CVEs
Exploited in the wildNo evidence yet
CISA KEVNot listed
Ransomware campaign useNot known
Affected products
Which versions
LI
likeshop · likeadmin-likeshop
through 3.0.5 · source: vendor
References
NVD
https://nvd.nist.gov/vuln/detail/CVE-2026-65707
CVE.org
https://www.cve.org/CVERecord?id=CVE-2026-65707
gist.github.com
https://gist.github.com/peoz14/794521dc40f5bb7e6a6ec6630d894be6
www.vulncheck.com
https://www.vulncheck.com/advisories/likeshop-authenticated-sql-injection-via-adjustaccount-endpoint