CVE-2026-65707 likeadmin-likeshop CVE debrief

Who should care

Administrators and users of Likeshop through version 3.0.5 should be aware of this vulnerability and take immediate action to mitigate the risk. This vulnerability is particularly concerning as it allows admin-level users to extract arbitrary database contents, potentially leading to sensitive information disclosure.

Technical summary

The vulnerability is caused by the lack of proper input validation and sanitization in the adjustAccount method of UserLogic.php. The money, integral, growth, and earnings parameters are concatenated directly into Db::raw() SQL fragments without type casting, numeric validation, or parameter binding. This allows admin-level users to inject malicious SQL code and extract arbitrary database contents.

Defensive priority

High

Recommended defensive actions

• Apply the latest patch or update to version 3.0.6 or later
• Implement additional input validation and sanitization for the adjustAccount endpoint
• Monitor for suspicious activity and implement logging and auditing mechanisms
• Consider implementing a web application firewall (WAF) to detect and prevent SQL injection attacks
• Review compensating controls for exposed systems while remediation is scheduled and verified
• Check relevant monitoring, detection, and logs for exposed assets that need extra review
• Track exceptions, retest remediated assets, and close the item only after evidence is documented

Evidence notes

The CVE record was published on 2026-07-24T17:17:34.290Z and was last modified on 2026-07-27T17:16:40.447Z. The NVD entry is currently Received. The vulnerability was disclosed by Vulncheck via two source references: a GitHub gist and a Vulncheck advisory.

Official resources