CVE-2026-65707

Name of the Vulnerable Software and Affected Versions Likeshop versions prior to 3.0.6

Description Authenticated users with admin-level privileges can extract arbitrary database contents, including credentials, personally identifiable information (PII), and session tokens. This occurs because the adjustAccount() function in UserLogic.php fails to perform type casting, numeric validation, or parameter binding when processing POST parameters. Specifically, the money, integral, growth, and earnings variables are concatenated directly into SQL fragments via the 'adjustAccount' endpoint, allowing for boolean-based binary-search extraction based on different response messages.

Recommendations Update Likeshop to version 3.0.6 or later. As a temporary mitigation, restrict access to the 'adjustAccount' endpoint to minimize the risk of exploitation.