The vulnerability stems from an unchecked user‑supplied parameter in the queryResult method of DataTableLists.php, enabling arbitrary SQL statements to be executed against the database. An attacker who can reach the Admin API endpoint can read, modify or delete data stored in the backend, compromising both confidentiality and integrity. The flaw does not provide direct code execution, but it does grant the attacker full control over database schema and contents.

The issue exists in likeadmin‑likeshop’s likeadmin_php component for all releases up to and including version 1.9.6. Systems exposing the DataTable Admin API endpoint through that component are vulnerable.

The CVSS score of 5.1 indicates moderate exploitation risk. The EPSS score of less than 1% suggests that active exploitation is unlikely as of the current data, and the vulnerability is not listed in the CISA KEV catalog. The attack vector is remote; a third‑party can trigger it by sending a crafted HTTP request to the vulnerable API, assuming no mitigating controls such as input validation or WAF are in place.