CVE-2026-65707 is an authenticated SQL injection vulnerability affecting likeshop through version 3.0.5. The adjustAccount method in UserLogic.php concatenates the money, integral, growth, and earnings POST parameters directly into Db::raw() SQL fragments without type casting, numeric validation, or parameter binding. This improper neutralization of special elements in SQL commands enables an attacker with admin privileges to perform boolean-based binary-search extraction of sensitive database contents, including credentials, personally identifiable information, and session tokens. The vulnerability has a CVSS 4.0 score of 8.5, indicating high severity, with network attack vector, low attack complexity, and no user interaction required.

An attacker with administrative privileges can exploit this vulnerability to extract arbitrary database contents, including sensitive credentials, personal information, and session tokens. This can lead to unauthorized data disclosure and potential further compromise of the application and its users. The vulnerability does not require user interaction and can be exploited remotely over the network.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until an official fix is available, restrict access to admin accounts and monitor for suspicious activity related to the adjustAccount endpoint. Avoid using vulnerable versions (<=3.0.5) in production environments if possible.