CVE-2026-11480

Chengdu Everbrite Network Technology BeikeShop Admin Design Builder Endpoint admin.php sql injection

State: Published
Severity: 5.3 Medium
Published: Jun 8, 2026
Updated: Jun 8, 2026
Reserved: Jun 7, 2026

Description

A vulnerability was found in Chengdu Everbrite Network Technology BeikeShop up to 1.6.0.22. Impacted is an unknown function of the file beike/Admin/Routes/admin.php of the component Admin Design Builder Endpoint. Performing a manipulation of the argument settings.value results in sql injection. It is possible to initiate the attack remotely. The exploit has been made public and could be used. The patch is named 2fa9805411088069fcc3b0c15b2f1f33d6e09958. To fix this issue, it is recommended to deploy a patch.

Scores

CVSS	Score	Vector	Source
4.0	5.3 Medium	CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:L/VI:L/VA:L/SC:N/SI:N/SA:N/E:P	VulDB
3.1	6.3 Medium	CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:L/E:P/RL:O/RC:C	VulDB
3.0	6.3 Medium	CVSS:3.0/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:L/E:P/RL:O/RC:C	VulDB
2.0	6.5 Medium	AV:N/AC:L/Au:S/C:P/I:P/A:P/E:POC/RL:OF/RC:C	VulDB

Weaknesses

CWE-89 SQL Injection
CWE-74 Injection

Affected Products

Product	Versions
BeikeShopChengdu Everbrite Network Technology	1.6.0.0Affected 1.6.0.1Affected 1.6.0.2Affected 1.6.0.3Affected 1.6.0.4Affected 1.6.0.5Affected 1.6.0.6Affected 1.6.0.7Affected 1.6.0.8Affected 1.6.0.9Affected 1.6.0.10Affected 1.6.0.11Affected 1.6.0.12Affected 1.6.0.13Affected 1.6.0.14Affected 1.6.0.15Affected 1.6.0.16Affected 1.6.0.17Affected 1.6.0.18Affected 1.6.0.19Affected 1.6.0.20Affected 1.6.0.21Affected 1.6.0.22Affected

References

VDB-369100 | Chengdu Everbrite Network Technology BeikeShop Admin Design Builder Endpoint admin.php sql injectionvdb-entrytechnical-description
VDB-369100 | CTI Indicators (IOB, IOC, TTP, IOA)signaturepermissions-required
CVE-2026-11480 | CVE Analysis and Reportthird-party-advisory
Submit #833973 | beikeshop 1.6.0.22 SQL Injectionthird-party-advisory
https://anonymous.4open.science/r/beikeshop-4B75/second-order-sqli-report.mdexploit
https://github.com/beikeshop/beikeshop/commit/2fa9805411088069fcc3b0c15b2f1f33d6e09958patch

Every record here comes from the CVE Program’s CVE List. © 1999–2026 The MITRE Corporation. CVE is a registered trademark of The MITRE Corporation. The records are reproduced under the CVE Program terms of use.