PT-2026-47242 · Beikeshop · Beikeshop

6Daksiadf4Bjujiv8Mwq · CVE-2026-11480 · Published 2026-06-08 · Updated 2026-06-08

Positive Technologies (AI Summary)

CVSS v2.0

6.5

Medium

Base vector

AV:N/AC:L/Au:S/C:P/I:P/A:P

Name of the Vulnerable Software and Affected Versions BeikeShop versions prior to 1.6.0.22

Description An issue exists in the Admin Design Builder Endpoint within the file beike/Admin/Routes/admin.php. A remote attacker can perform a manipulation of the settings.value argument to execute a SQL injection, which is a technique where malicious SQL statements are inserted into entry fields for execution.

Recommendations Deploy patch 2fa9805411088069fcc3b0c15b2f1f33d6e09958 for versions prior to 1.6.0.22.

Exploit

Fix

SQL injection

Special Elements Injection

Weakness Enumeration

CWE-89

CWE-74

Related Identifiers

CVE-2026-11480

Affected Products

Beikeshop

References · 12

• 🔥 https://github.com/CVEProject/cvelistV5/tree/main/cves/2026/11xxx/CVE-2026-11480.json · Exploit
• 🔥 https://anonymous.4open.science/r/beikeshop-4B75/second-order-sqli-report.md · Exploit
• https://github.com/beikeshop/beikeshop/commit/2fa9805411088069fcc3b0c15b2f1f33d6e09958 · Patch
• https://osv.dev/vulnerability/CVE-2026-11480 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2026-11480 · Security Note
• https://vuldb.com/vuln/369100/cti · Note
• https://twitter.com/VulmonFeeds/status/2063839358252109909 · Twitter Post
• https://t.me/cveNotify/166450 · Telegram Post
• https://t.me/CVEtracker/56124 · Telegram Post
• https://vuldb.com/submit/833973 · Note
• https://vuldb.com/cve/CVE-2026-11480 · Note
• https://vuldb.com/vuln/369100 · Note