BeikeShop CVE-2026-11480

Q: What is the CVSS score of CVE-2026-11480?

CVE-2026-11480 has a CVSS 4.0 base score of 2.1 (Low). CVSS vector: CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:L/VI:L/VA:L/SC:N/SI:N/SA:N/E:P/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X. EPSS exploitation probability: 0.0%.

EUVD-2026-35011 LOW

Improper Neutralization of Special Elements in Output Used by a Downstream Component ('Injection') (CWE-74)

2026-06-08 cna@vuldb.com

GHSA-gc38-mm4v-43v4

PHP SQLi

2.1

CVSS 4.0 · NVD

Severity by source

NVD PRIMARY

2.1 LOW

CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:L/VI:L/VA:L/SC:N/SI:N/SA:N/E:P/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X

Primary rating from NVD · only source for this CVE.

CVSS VectorNVD

CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:L/VI:L/VA:L/SC:N/SI:N/SA:N/E:P/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X

Attack Vector

Network

Attack Complexity

Low

Privileges Required

Low

User Interaction

None

Scope

Lifecycle Timeline

Source Code Evidence Fetched

Jun 08, 2026 - 03:30 vuln.today

Analysis Generated

Jun 08, 2026 - 03:30 vuln.today

DescriptionCVE.org

A vulnerability was found in Chengdu Everbrite Network Technology BeikeShop up to 1.6.0.22. Impacted is an unknown function of the file beike/Admin/Routes/admin.php of the component Admin Design Builder Endpoint. Performing a manipulation of the argument settings.value results in sql injection. It is possible to initiate the attack remotely. The exploit has been made public and could be used. The patch is named 2fa9805411088069fcc3b0c15b2f1f33d6e09958. To fix this issue, it is recommended to deploy a patch.

AnalysisAI

Second-order SQL injection in BeikeShop's Admin Design Builder endpoint (versions up to 1.6.0.22) allows authenticated admin-panel users to manipulate the settings.value argument in beike/Admin/Routes/admin.php to inject arbitrary SQL. The root cause spans multiple PHP repository classes - DesignService.php, BrandRepo.php, and ProductRepo.php - where brand and product ID arrays were passed to database queries without integer casting or sanitization. A public proof-of-concept exploit exists; the CVSS 4.0 score of 2.1 reflects the administrative authentication prerequisite that meaningfully constrains real-world exposure.

Technical ContextAI

BeikeShop is a PHP-based open-source e-commerce platform. The vulnerability is rooted in CWE-74 (Improper Neutralization of Special Elements in Output Used by a Downstream Component - Injection), specifically SQL injection. The commit diff reveals that the Admin Design Builder's module-handling logic in DesignService::handleRequestModules() passed unsanitized content arrays - specifically brand and product ID collections - directly downstream to BrandRepo::getNames() and ProductRepo::getBuilder(), where they were interpolated into database queries without type enforcement. The fix introduces integer casting via array_map('intval', ...) and positive-value filtering at both the service layer (sanitizeModuleData() / sanitizeIds()) and the repository layer. This is a classic second-order injection pattern: user-supplied data is stored or processed through an intermediate structure before reaching the vulnerable query execution point.

RemediationAI

The upstream fix is available as GitHub commit 2fa9805411088069fcc3b0c15b2f1f33d6e09958 on the beikeshop/beikeshop repository; this is an upstream commit rather than a tagged release, so a patched version number has not been independently confirmed - operators should verify whether a formal release incorporating this commit has been published and upgrade accordingly. The patch enforces integer sanitization of brand and product ID arrays at both the service layer (via the new sanitizeModuleData() method) and the repository layer, eliminating the injection surface entirely. As a compensating control where patching is not immediately feasible, restrict network access to the admin panel to trusted IP ranges or VPN, enforce strong unique credentials for all admin accounts, and consider enabling a web application firewall rule targeting SQL metacharacters in Design Builder API parameters. Restricting admin panel exposure reduces the attack surface given the PR:L requirement; note that WAF rules may generate false positives on legitimate design builder payloads and should be tested in audit mode first.