The vulnerability is an authenticated SQL injection (CWE-89) that occurs in the adjustAccount endpoint of Likeshop. Admin‑level users can send arbitrary POST parameters—money, integral, growth, and earnings—that are concatenated directly into SQL fragments without any casting or validation. This allows a well‑aimed boolean‑based binary search to retrieve sensitive data, including credentials, PII, and session tokens, from the database. The injection requires that the user already has administrative privileges, but once achieved, the attacker can read any data the database contains.

Likeshop version 3.0.5 is affected. The product is provided by the likeadmin company under the name Likeshop. Only authenticated admin accounts are capable of invoking the vulnerable adjustAccount endpoint.

The CVSS score of 8.5 indicates a high‑severity flaw. The EPSS score of less than 1% indicates a very low probability of exploitation at this time, and the vulnerability is not listed in the CISA KEV catalog. The attack vector is limited to users who can authenticate to the system as administrators, and the exploit relies on distinct success and failure responses, implying that a limited amount of trial‑and‑error is required to extract data.