CVE-2026-7083: likeadmin_php SQL Injection Vulnerability

CVE-2026-7083 Overview

A SQL Injection vulnerability has been identified in likeadmin-likeshop likeadmin_php up to version 1.9.6. The vulnerability exists in the queryResult function within the file server\app\adminapi\lists\tools\DataTableLists.php of the dataTable Admin API component. This flaw allows authenticated attackers with high privileges to manipulate database queries through injection attacks, potentially compromising data confidentiality, integrity, and availability.

Critical Impact
Authenticated attackers with administrative privileges can exploit this SQL injection vulnerability remotely to extract, modify, or delete sensitive database information through the vulnerable dataTable Admin API endpoint.

Affected Products

likeadmin-likeshop likeadmin_php versions up to and including 1.9.6
DataTable Admin API component (DataTableLists.php)
Deployments utilizing the queryResult function in administrative interfaces

Discovery Timeline

2026-04-27 - CVE-2026-7083 published to NVD
2026-04-29 - Last updated in NVD database

Technical Details for CVE-2026-7083

Vulnerability Analysis

This SQL Injection vulnerability (CWE-74: Injection) affects the administrative API interface of likeadmin_php, a PHP-based e-commerce administration platform. The vulnerability resides specifically in the queryResult function within DataTableLists.php, which handles data table queries for the admin panel.

The flaw enables remote exploitation, though it requires high-privilege authentication to access the vulnerable endpoint. The attack exploits improper input sanitization in the dataTable Admin API, allowing malicious SQL statements to be injected into database queries. Successful exploitation can lead to limited unauthorized access to confidential data, minor data modifications, and potential service disruption.

The project maintainers were notified through a GitHub Issue #8 Discussion, but have not responded as of the last update. Public exploit information has been disclosed through VulDB Submission #799570.

Root Cause

The root cause of this vulnerability is improper input validation and sanitization within the queryResult function. User-supplied input passed to the dataTable Admin API is not adequately filtered or parameterized before being incorporated into SQL queries, allowing attackers to inject arbitrary SQL commands.

This represents a classic injection vulnerability (CWE-74) where the application fails to properly separate data from code in database operations, enabling attackers to manipulate the intended query logic.

Attack Vector

The attack is network-based and requires the attacker to have high-privilege administrative access to the likeadmin_php application. Once authenticated, the attacker can craft malicious requests to the dataTable Admin API endpoint that include SQL injection payloads.

The vulnerable queryResult function processes these payloads without proper sanitization, allowing the injected SQL to execute against the backend database. The attacker can leverage this to read sensitive data from database tables, modify existing records, or potentially disrupt database operations.

For detailed technical information about the exploitation methodology, refer to the VulDB #359658 Vulnerability entry which contains additional CTI information.

Detection Methods for CVE-2026-7083

Indicators of Compromise

Unusual or malformed requests to the /adminapi/lists/tools/DataTableLists.php endpoint
SQL error messages appearing in application logs indicating injection attempts
Unexpected database queries containing SQL keywords like UNION, SELECT, DROP, or -- comment markers in Admin API request logs
Administrative session activity from unusual IP addresses or at abnormal times

Detection Strategies

Implement Web Application Firewall (WAF) rules to detect SQL injection patterns in Admin API requests
Monitor database query logs for anomalous queries originating from the DataTableLists component
Deploy application-level intrusion detection to identify SQL injection signatures in HTTP request parameters
Review authentication logs for suspicious high-privilege account activity targeting admin API endpoints

Monitoring Recommendations

Enable detailed logging for all Admin API requests, particularly those accessing the dataTable functionality
Configure database audit logging to capture queries executed by the web application service account
Set up alerting for SQL syntax errors that may indicate active injection attempts
Monitor for data exfiltration patterns such as large result sets or unusual data access patterns from administrative interfaces

How to Mitigate CVE-2026-7083

Immediate Actions Required

Restrict access to the Admin API endpoints using network-level controls or IP whitelisting
Implement additional authentication requirements for administrative functions
Deploy a Web Application Firewall with SQL injection protection rules for the affected endpoint
Review database access permissions and apply the principle of least privilege to the application database account

Patch Information

As of the last update, the likeadmin-likeshop project has not responded to the vulnerability disclosure reported through the GitHub Issue #8 Discussion. Users should monitor the GitHub Repository for LikeAdmin for official security patches.

Until an official patch is available, organizations should implement the workarounds and compensating controls described below and consider the risk of continued use of affected versions.

Workarounds

Disable or restrict access to the dataTable Admin API endpoint if not required for operations
Implement input validation at the web server or reverse proxy level to filter common SQL injection patterns
Use prepared statements or parameterized queries in any custom code interacting with the affected component
Consider deploying the application behind a WAF configured with strict SQL injection detection rules

bash

# Example: Apache mod_security rule to detect SQL injection patterns
SecRule ARGS "@detectSQLi" \
    "id:1001,\
    phase:2,\
    block,\
    log,\
    msg:'SQL Injection attempt detected on Admin API',\
    logdata:'Matched Data: %{MATCHED_VAR}'"