CVE-2026-65707 is an authenticated SQL injection vulnerability in likeadmin-likeshop likeshop affecting versions up to 3.0.5. The adjustAccount method in UserLogic.php concatenates the money, integral, growth, and earnings POST parameters directly into Db::raw() SQL fragments without type casting, numeric validation, or parameter binding. This improper neutralization of special elements enables an attacker with admin privileges to perform boolean-based binary-search extraction of sensitive data from the database by observing distinct success and failure responses.

An attacker with admin-level access can exploit this vulnerability to extract arbitrary database contents, including credentials, personally identifiable information (PII), and session tokens. This can lead to significant data exposure and compromise of user accounts and sessions. The CVSS 4.0 base score of 8.5 reflects high severity due to network attack vector, low attack complexity, no user interaction, and high impact on confidentiality and integrity.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until an official fix is available, restrict admin access to trusted personnel only and monitor for suspicious activity related to the adjustAccount endpoint. Avoid using affected versions in production environments if possible.