CVE-2026-65707 Likeshop 3.0.5 Authenticated SQL Injection via adjustAccount Endpoint
Authenticated admin users can extract arbitrary database contents via SQL injection in the adjustAccount endpoint of Likeshop.
- Exploited in the wild
- Not known
- Login needed
- An administrator
- Attackable
- Over the internet
- Victim action needed
- Not needed
- Fix
- None listed
What is CVE-2026-65707?
CVE-2026-65707 is a high-severity SQL injection vulnerability in likeadmin-likeshop likeshop, published on 24 Jul 2026. An attacker needs administrator access to exploit it, with no action from the victim.
Official description
Likeshop through 3.0.5 contains an authenticated SQL injection vulnerability that allows admin-level users to extract arbitrary database contents by submitting unsanitized POST parameters to the adjustAccount endpoint. The adjustAccount method in UserLogic.php concatenates the money, integral, growth, and earnings parameters directly into Db::raw() SQL fragments without type casting, numeric validation, or parameter binding, enabling boolean-based binary-search extraction of credentials, PII, and session tokens via distinct success and failure response messages.
Weakness: CWE-89
Which versions are affected by CVE-2026-65707?
How do I fix CVE-2026-65707?
No fix has been published for CVE-2026-65707 yet. Limit exposure of the affected software until one is available.
Use parameterised queries everywhere and never build SQL by joining strings. Upgrade affected software first; a web application firewall only buys time. More about SQL injection.
Is CVE-2026-65707 being exploited?
It is not confirmed as exploited in the wild, but public exploit code for CVE-2026-65707 exists.
Sources
Also known as GHSA-xvrr-g8q6-2w6q.