Likeadmin-Likeshop Likeadmin_Php SQL Injection Vulnerability

A SQL injection vulnerability exists in Likeadmin-Likeshop Likeadmin_Php versions through 1.9.6. The issue is located in the DataTable Admin API, specifically within the queryResult function of the file server\app\adminapi\lists\tools\DataTableLists.php. This vulnerability allows authenticated administrators to execute arbitrary SQL commands, potentially leading to unauthorized data access, data manipulation, and under certain conditions, remote code execution.

Impact

Exploitation of this vulnerability allows for SQL injection, where an attacker can manipulate SQL queries to execute arbitrary SQL commands. This could result in unauthorized data access, data modification, and potentially remote code execution, depending on the application's database interaction.

Reproduction

To reproduce this vulnerability, an authenticated administrator can send a request to the /adminapi/tools.generator/dataTable endpoint with crafted 'name' or 'comment' parameters that include SQL injection payloads. The injection can be verified by observing the application's response, such as a delay indicating the execution of a time-based payload.

Remediation

It is recommended to update to a version of Likeadmin-Likeshop Likeadmin_Php that is not vulnerable to SQL injection. If available, apply any security patches provided by the developer.