CVE-2026-65707
Received Received - Intake

Authenticated SQL Injection in Likeshop via adjustAccount Endpoint

Publication date: 2026-07-24

Last updated on: 2026-07-24

Assigner: VulnCheck

Description
Likeshop through 3.0.5 contains an authenticated SQL injection vulnerability that allows admin-level users to extract arbitrary database contents by submitting unsanitized POST parameters to the adjustAccount endpoint. The adjustAccount method in UserLogic.php concatenates the money, integral, growth, and earnings parameters directly into Db::raw() SQL fragments without type casting, numeric validation, or parameter binding, enabling boolean-based binary-search extraction of credentials, PII, and session tokens via distinct success and failure response messages.

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published
2026-07-24
Last Modified
2026-07-24
Generated
2026-07-24
AI Q&A
2026-07-24
EPSS Evaluated
N/A
NVD
CVE-2026-65707
EUVD
EUVD-2026-48713

Affected Vendors & Products

Showing 1 associated CPE
Vendor Product Version / Range
likeshop likeshop to 3.0.5 (inc)

Helpful Resources

Exploitability

CWE
CWE Icon
KEV
KEV Icon
CWE ID Description
CWE-89 The product constructs all or part of an SQL command using externally-influenced input from an upstream component, but it does not neutralize or incorrectly neutralizes special elements that could modify the intended SQL command when it is sent to a downstream component. Without sufficient removal or quoting of SQL syntax in user-controllable inputs, the generated SQL query can cause those inputs to be interpreted as SQL instead of ordinary user data.

Attack-Flow Graph

AI Quick Actions

Instant insights powered by AI
Executive Summary

This is an authenticated SQL injection vulnerability in Likeshop through version 3.0.5. Admin-level users can exploit it by sending unsanitized POST parameters to the adjustAccount endpoint. The adjustAccount method in UserLogic.php directly inserts money, integral, growth, and earnings parameters into raw SQL queries without validation or parameter binding, allowing attackers to extract database contents.

Detection Guidance

To detect this vulnerability, inspect Likeshop admin dashboard requests to the adjustAccount endpoint for unsanitized POST parameters like money, integral, growth, or earnings. Monitor SQL error messages or timing differences in responses when submitting crafted inputs.

Impact Analysis

An attacker with admin access could extract sensitive data like credentials, personally identifiable information (PII), or session tokens from the database. This could lead to unauthorized account access, data breaches, or further exploitation of the system.

Compliance Impact

This vulnerability could result in unauthorized access to personal data, violating GDPR's data protection principles and HIPAA's security requirements for protected health information. Organizations may face legal penalties, fines, or reputational damage due to non-compliance.

Mitigation Strategies

Immediately update Likeshop to version 3.0.6 or later. If unavailable, apply input validation and parameter binding to the adjustAccount endpoint in UserLogic.php. Restrict admin access to trusted networks and monitor for unusual database queries.

Chat Assistant

Ask questions about this CVE
Hi! I’m here to help you understand CVE-2026-65707. Ask me anything about the vulnerability, its impact, or mitigation strategies.
0/70

EPSS Chart