CVE-2026-65707 Overview
CVE-2026-65707 is an authenticated SQL injection vulnerability in Likeshop through version 3.0.5. The flaw resides in the adjustAccount endpoint, where admin-level users can submit unsanitized POST parameters that are concatenated directly into raw SQL fragments. Attackers holding administrative credentials can exfiltrate database contents including credentials, personally identifiable information (PII), and session tokens. The vulnerability is tracked under CWE-89 (Improper Neutralization of Special Elements used in an SQL Command).
Critical Impact
Authenticated administrators can perform boolean-based binary-search extraction of arbitrary database contents through the money, integral, growth, and earnings parameters of the adjustAccount endpoint.
Affected Products
- Likeshop through version 3.0.5
- UserLogic.php component containing the adjustAccount method
- Deployments exposing the admin adjustAccount endpoint over the network
Discovery Timeline
- 2026-07-24 - CVE-2026-65707 published to NVD
- 2026-07-28 - Last updated in NVD database
Technical Details for CVE-2026-65707
Vulnerability Analysis
The vulnerability exists in the adjustAccount method within UserLogic.php. The method accepts four numeric-intent parameters — money, integral, growth, and earnings — from admin POST requests. These values are concatenated directly into Db::raw() SQL fragments without type casting, numeric validation, or parameter binding. As a result, the values reach the database engine as attacker-controlled SQL expressions rather than sanitized literals.
Exploitation requires authenticated admin access, which limits the attacker population but does not neutralize impact. Compromised admin credentials, insider misuse, or chained lower-severity flaws that grant admin access all enable this vector. Once inside the endpoint, an attacker crafts payloads that produce distinct success and failure response messages, allowing boolean-based inference of arbitrary database content one bit at a time.
Root Cause
The root cause is unsafe use of the ThinkPHP Db::raw() construct. Db::raw() bypasses the framework's parameter binding and inserts its argument verbatim into the generated SQL statement. Passing user-controlled POST values into Db::raw() without prior validation defeats the ORM's built-in protection against injection.
Attack Vector
An authenticated administrator sends a crafted POST request to the adjustAccount endpoint with a SQL expression embedded in one of the four numeric parameters. The application returns a different response message depending on whether the injected boolean condition evaluates true or false. The attacker iterates over rows and characters, using binary search to reconstruct target values such as password hashes, API keys, or session tokens. No verified public exploit code is currently listed in the CVE record, though a GitHub Gist PoC and the VulnCheck Security Advisory document the technique.
Detection Methods for CVE-2026-65707
Indicators of Compromise
- POST requests to the adjustAccount endpoint containing SQL keywords such as SELECT, IF, SLEEP, SUBSTRING, or CASE inside the money, integral, growth, or earnings fields.
- High-volume, sequential requests from a single admin session producing alternating success and failure response messages.
- Admin session activity originating from unexpected geolocations or user agents.
Detection Strategies
- Enable full request-body logging on the Likeshop admin API and alert on non-numeric characters within the four affected parameters.
- Deploy web application firewall (WAF) rules that reject SQL metacharacters in the adjustAccount request body.
- Correlate admin authentication events with subsequent bursts of adjustAccount requests to identify automated extraction.
Monitoring Recommendations
- Monitor database query logs for Db::raw() fragments containing suspicious substrings, comparison operators, or nested SELECTs.
- Track baseline request rates against the adjustAccount endpoint and alert on statistically significant deviations.
- Review admin account creation and privilege changes to detect precursor activity that could unlock this endpoint.
How to Mitigate CVE-2026-65707
Immediate Actions Required
- Restrict network access to the Likeshop admin interface to trusted management networks or VPN users only.
- Rotate all administrator credentials and enforce multi-factor authentication on admin accounts.
- Review database audit logs for prior evidence of injection against the adjustAccount endpoint since deployment.
Patch Information
As of the last modification date of 2026-07-28, no vendor patch is listed in the NVD record for Likeshop 3.0.5 or earlier. Operators should track the VulnCheck Security Advisory for fix availability and apply updates as soon as the vendor publishes a corrected UserLogic.php.
Workarounds
- Apply a virtual patch at the WAF that enforces strict numeric-only regex validation on the money, integral, growth, and earnings parameters.
- Modify UserLogic.php locally to cast the four parameters with intval() or floatval() before they reach Db::raw().
- Disable the adjustAccount endpoint entirely if manual account adjustments are not required for business operations.
Disclaimer: This content was generated using AI. While we strive for accuracy, please verify critical information with official sources.
