CVE-2026-11480: BeikeShop SQL Injection Vulnerability

CVE-2026-11480 Overview

CVE-2026-11480 is a second-order SQL injection vulnerability in Chengdu Everbrite Network Technology BeikeShop versions up to 1.6.0.22. The flaw resides in the Admin Design Builder endpoint defined in beike/Admin/Routes/admin.php. An authenticated attacker can manipulate the settings.value parameter to inject SQL statements that are executed when stored design module identifiers are later used in database queries. The issue has been classified under CWE-74 (Improper Neutralization of Special Elements in Output Used by a Downstream Component). A public exploit exists, and the upstream project has released commit 2fa9805411088069fcc3b0c15b2f1f33d6e09958 to address the flaw.

Critical Impact
Authenticated admin-tier users can inject SQL through stored design module identifiers, leading to limited disclosure or tampering of backend data on affected BeikeShop installations.

Affected Products

Chengdu Everbrite Network Technology BeikeShop versions up to and including 1.6.0.22
Component: Admin Design Builder Endpoint (beike/Admin/Routes/admin.php)
Downstream repositories beike/Repositories/BrandRepo.php and beike/Repositories/ProductRepo.php

Discovery Timeline

2026-06-08 - CVE-2026-11480 published to NVD
2026-06-08 - Last updated in NVD database

Technical Details for CVE-2026-11480

Vulnerability Analysis

The vulnerability is a second-order SQL injection. Attacker-controlled identifiers submitted through the Admin Design Builder are persisted via the settings.value field without strict type validation. When the application later reads these stored values and passes them into Eloquent query builders such as whereIn('products.id', $productIds), the unsanitized identifiers reach the database layer and modify the resulting SQL statement. Because the injection point is reached only when the stored design data is rendered, classical input-time filters fail to catch it. The exploitable code paths exist in BrandRepo::getListByIds() and ProductRepo filtering by product_ids, where arrays of identifiers are consumed directly.

Root Cause

The root cause is the absence of integer coercion and positive-value filtering on design module identifiers before they are used in SQL builders. The patched code applies array_map('intval', ...) together with array_filter to reject non-positive values, preventing arbitrary strings from reaching query construction.

Attack Vector

Exploitation requires network access to the admin panel and authenticated low-privilege admin credentials. The attacker submits a crafted settings.value payload through the design builder. The malicious identifier is stored and later interpolated into a SQL query during a subsequent admin or frontend request, triggering execution of the injected SQL.

php

// Patch in beike/Repositories/BrandRepo.php
public static function getListByIds($ids)
{
    $ids = array_values(array_filter(array_map('intval', (array) $ids), function ($id) {
        return $id > 0;
    }));

    if (empty($ids)) {
        return [];
    }
}
// Source: https://github.com/beikeshop/beikeshop/commit/2fa9805411088069fcc3b0c15b2f1f33d6e09958

php

// Patch in beike/Repositories/ProductRepo.php
$productIds = array_values(array_filter(array_map('intval', (array) ($filters['product_ids'] ?? [])), function ($id) {
    return $id > 0;
}));

if ($productIds) {
    $builder->whereIn('products.id', $productIds);
}
// Source: https://github.com/beikeshop/beikeshop/commit/2fa9805411088069fcc3b0c15b2f1f33d6e09958

Detection Methods for CVE-2026-11480

Indicators of Compromise

Unexpected non-numeric values stored in the BeikeShop settings table for design module identifier fields.
Database error log entries from the BeikeShop application referencing malformed whereIn clauses on products.id or brand identifier lookups.
Admin Design Builder save requests containing SQL meta-characters such as quotes, parentheses, or UNION tokens in settings.value.

Detection Strategies

Inspect web server access logs for POST requests to administrative design-builder routes carrying suspicious settings.value payloads.
Audit BeikeShop installations for the BeikeShop version string and confirm whether commit 2fa9805411088069fcc3b0c15b2f1f33d6e09958 has been applied.
Review query logs from the database backend for syntactically anomalous statements originating from the BeikeShop application user.

Monitoring Recommendations

Enable verbose query logging on the BeikeShop database during incident review to capture injected statements at the point of execution.
Monitor admin authentication events for unusual session creation followed by design-builder modifications.
Alert on application exceptions thrown from BrandRepo::getListByIds() or ProductRepo filter handling, which can indicate failed injection attempts.

How to Mitigate CVE-2026-11480

Immediate Actions Required

Apply the upstream patch by updating to a BeikeShop build that includes commit 2fa9805411088069fcc3b0c15b2f1f33d6e09958.
Restrict access to the BeikeShop admin panel to trusted networks using IP allowlisting or VPN until the patch is deployed.
Rotate administrator credentials and review existing admin accounts for unauthorized additions.

Patch Information

The vendor has released a fix in commit 2fa9805411088069fcc3b0c15b2f1f33d6e09958 that sanitizes design module identifiers in beike/Repositories/BrandRepo.php and beike/Repositories/ProductRepo.php. The fix applies intval coercion and rejects non-positive identifiers before they reach the query builder. See the GitHub Commit Changes and the Anonymous Report on SQLi for full technical context.

Workarounds

Place a web application firewall rule in front of the admin design-builder endpoint to block settings.value payloads containing SQL meta-characters.
Limit which administrator roles can access design-builder functionality until the upstream patch is applied.
Manually audit and clean the BeikeShop settings table to remove any stored non-integer design module identifier values.

bash

# Apply the upstream security patch on a BeikeShop deployment
cd /var/www/beikeshop
git fetch origin
git cherry-pick 2fa9805411088069fcc3b0c15b2f1f33d6e09958
php artisan config:clear
php artisan cache:clear