| शीर्षक | Guangzhou Duoduo Information Technology Co., Ltd. likeadmin_php <= 1.9.6 SQL Injection |
|---|
| विवरण | A SQL injection vulnerability exists in the /adminapi/tools.generator/dataTable endpoint of likeadmin_php. The backend directly concatenates user-supplied input parameters (such as name and comment) into SQL queries without proper sanitization or parameterization. An authenticated attacker with administrative privileges can exploit this vulnerability to execute arbitrary SQL statements, leading to sensitive data disclosure, data manipulation, and potentially remote code execution (RCE) under certain conditions. |
|---|
| स्रोत | ⚠️ https://github.com/likeadmin-likeshop/likeadmin_php/issues/8 |
|---|
| उपयोगकर्ता | z0ng (UID 96775) |
|---|
| सबमिशन | 08/04/2026 10:48 AM (19 दिन पहले) |
|---|
| संयम | 26/04/2026 10:03 AM (18 days later) |
|---|
| स्थिति | स्वीकृत |
|---|
| VulDB प्रविष्टि | 359658 [likeadmin-likeshop likeadmin_php तक 1.9.6 dataTable Admin API DataTableLists.php queryResult SQL इंजेक्शन] |
|---|
| अंक | 20 |
|---|