Executive brief
BeikeShop, an open-source e-commerce platform, contains a security vulnerability in its homepage design feature. An attacker with low-level administrative access can inject malicious code into the website's configuration. When customers visit the store's homepage, this code executes against the database, potentially allowing the attacker to access sensitive information or disrupt the website's operations.
Technical details
A second-order SQL injection vulnerability exists in BeikeShop versions up to 1.6.0.22. The root cause is the improper neutralization of special elements in the 'settings.value' argument within the Admin Design Builder Endpoint (beike/Admin/Routes/admin.php). An attacker with 'design_update' privileges can submit malicious JSON payloads via a PUT request to /admin/design/builder, which are stored in the database. When the frontend homepage is subsequently rendered, the application retrieves these values and concatenates them directly into dynamic SQL queries using the orderByRaw() function in BrandRepo.php and ProductRepo.php. This allows for remote code execution against the database. A patch (commit 2fa9805) has been released to sanitize design module IDs.
Affected products
- Chengdu Everbrite Network Technology BeikeShop up to 1.6.0.22
Timeline
- 2026-06-08: advisory: NVD publication date
- 2026-06-07: disclosed: Initial disclosure via VulDB
- 2026-06-07: patched: Patch commit 2fa9805411088069fcc3b0c15b2f1f33d6e09958 released