SQL Injection Vulnerability in Abdurrab5 online-makeup-store

A SQL injection vulnerability, tracked as CVE-2026-96601, has been identified in the Abdurrab5 online-makeup-store web application. The vulnerability resides within the Admin Login Handler component, specifically affecting the processing of input passed to the index.php script. An unauthenticated remote attacker can inject malicious SQL commands into the 'id' or 'password' arguments to bypass authentication or extract sensitive data from the backend database. As the application utilizes a rolling release model, there is no specific version identifier to patch against; users are advised to verify their implementation against the vulnerable file path. Public exploits for this vulnerability are currently available, increasing the risk of opportunistic exploitation.

Impact

Successful exploitation of CVE-2026-96601 allows unauthorized access to administrative functions of the online-makeup-store. An attacker could potentially retrieve, modify, or delete database contents, leading to account takeover or full compromise of the application's backend data.

Recommendation

Detection engineering teams should focus on monitoring web server access logs for anomalous patterns indicative of SQL injection attempts targeting the Admin Login Handler.

• Implement input validation and parameterized queries for the 'id' and 'password' parameters in index.php.
• Deploy web application firewall (WAF) rules to inspect POST and GET requests to index.php for common SQL injection syntax (e.g., OR 1=1, UNION SELECT, --).
• Review web server logs for high-frequency or anomalous status codes (4xx/5xx) associated with the /index.php path from external IP addresses.