Peoz

**Name of the Vulnerable Software and Affected Versions** Likeshop versions prior to 3.0.6 **Description** Authenticated users with admin-level privileges can extract arbitrary database contents, including credentials, personally identifiable information (PII), and session tokens. This occurs because the `adjustAccount()` function in UserLogic.php fails to perform type casting, numeric validation, or parameter binding when processing POST parameters. Specifically, the `money`, `integral`, `growth`, and `earnings` variables are concatenated directly into SQL fragments via the 'adjustAccount' endpoint, allowing for boolean-based binary-search extraction based on different response messages. **Recommendations** Update Likeshop to version 3.0.6 or later. As a temporary mitigation, restrict access to the 'adjustAccount' endpoint to minimize the risk of exploitation.