This vulnerability involves an SQL injection flaw in the BeikeShop product by Chengdu Everbrite Network Technology, affecting versions up to 1.6.0.22. The issue arises from improper sanitization of the settings.value argument in the Admin Design Builder Endpoint within the admin.php file. An attacker can remotely exploit this to inject SQL commands. The vulnerability has a CVSS 4.0 base score of 5.3, indicating medium severity. A patch has been made available (commit 2fa9805411088069fcc3b0c15b2f1f33d6e09958) to fix the issue.

Successful exploitation of this vulnerability could allow an attacker to perform SQL injection attacks remotely, potentially leading to unauthorized access or manipulation of the backend database. The exact impact depends on the database and application context but generally includes data disclosure, modification, or disruption of service. No known active exploitation in the wild has been reported.

A patch identified by commit 2fa9805411088069fcc3b0c15b2f1f33d6e09958 is available and should be applied promptly to affected versions of BeikeShop (up to 1.6.0.22). There is no vendor advisory explicitly stating otherwise, so deploying this official fix is the recommended remediation. Patch status is confirmed by the presence of the patch commit reference. No additional mitigations are specified.