CVE-2026-7083 — Likeadmin-Likeshop Likeadmin_php SQL Injection

title: SQL Injection in Likeadmin DataTableLists.php - CVE-2026-7083
id: scw-2026-04-27-ai-1
status: experimental
level: high
description: |
  Detects SQL injection attempts targeting the DataTableLists.php script in Likeadmin, specifically within the queryResult function. This rule looks for the presence of 'UNION' and 'SELECT' keywords within the URI query string, indicative of a common SQL injection technique used to exploit CVE-2026-7083.
author: SCW Feed Engine (AI-generated)
date: 2026-04-27
references:
  - https://shimiscyberworld.com/posts/nvd-CVE-2026-7083/
tags:
  - attack.initial_access
  - attack.t1190
logsource:
    category: webserver
detection:
  selection:
      cs-uri|contains:
          - '/server/app/adminapi/lists/tools/DataTableLists.php'
      cs-uri-query|contains:
          - 'queryResult'
      cs-uri-query|contains:
          - 'UNION'
      cs-uri-query|contains:
          - 'SELECT'
      condition: cs-uri AND cs-uri-query
falsepositives:
  - Legitimate administrative activity

Source: Shimi's Cyber World · License & reuse