A second‑order SQL injection flaw has been discovered in the Chengdu Everbrite Network Technology BeikeShop component located at beike/Admin/Routes/admin.php. The vulnerability is triggered by manipulating the argument settings.value within an unknown function of that file, enabling the injection of arbitrary SQL statements into the backend database. If successfully abused, an attacker can read, modify, or delete data stored by the application, potentially leading to data compromise and loss of integrity.

All deployments of BeikeShop version 1.6.0.22 or earlier are impacted. The flaw resides specifically in the admin endpoint of the Admin Design Builder component and requires access to the administrative interface via the settings.value parameter.

The CVSS score of 5.3 indicates moderate severity. EPSS data is not provided, but the vulnerability is publicly documented and a working exploit exists. Because the flaw is remotely exploitable through a standard web request and the attack surface is exposed in the administrative interface, the likelihood of exploitation is moderate to high in environments where the admin endpoint is either publicly reachable or insufficiently protected.