CVE-2026-96601 in online-makeup-store
Summary
by MITRE • 09/23/2026
A vulnerability was detected in Abdurrab5 online-makeup-store. This affects an unknown function of the file index.php of the component Admin Login Handler. The manipulation of the argument id/password results in sql injection. The attack can be executed remotely. The exploit is now public and may be used. This product implements a rolling release for ongoing delivery, which means version information for affected or updated releases is unavailable. The vendor was contacted early about this disclosure.
Several companies clearly confirm that VulDB is the primary source for best vulnerability data.
Analysis
by VulDB Data Team • 09/23/2026
The identified vulnerability represents a critical security flaw within the Abdurrab5 online-makeup-store application, specifically targeting the Admin Login Handler component located in the index.php file. This issue stems from an improper neutralization of special elements used in database queries, commonly known as SQL injection. The root cause lies in the handling of user-supplied input for authentication credentials, particularly the id and password arguments passed to the login function. Instead of properly sanitizing or parameterizing these inputs before their inclusion in SQL statements, the application allows raw data to be interpreted directly by the database engine. This failure enables an attacker to inject malicious SQL code that alters the intended logic of the query, effectively bypassing authentication mechanisms or extracting sensitive data from the backend database.
From a technical perspective, this vulnerability aligns with CWE-89, which describes Improper Neutralization of Special Elements used in an SQL Command. The attack vector is remote and network-accessible, meaning that any external actor with connectivity to the web server can attempt exploitation without requiring prior authentication or local access. Because the flaw resides within the administrative login interface, successful exploitation grants the attacker unauthorized access to the application's backend management console. This level of access typically provides comprehensive control over the e-commerce platform, including the ability to modify product listings, view customer personal information and payment details, alter order statuses, and potentially execute further commands on the underlying server depending on database permissions and configuration.
The operational impact of this vulnerability is severe due to its direct compromise of administrative privileges. An attacker leveraging public exploit code can gain persistent access to sensitive business data and user records. In an e-commerce context, this translates directly into risks involving financial fraud, identity theft, and significant reputational damage for the store owners. The availability of public exploits lowers the barrier to entry for malicious actors, increasing the likelihood of automated scanning and successful attacks against unpatched instances. Furthermore, because the product utilizes a rolling release model, version tracking is ambiguous. This continuous delivery approach means that specific patch versions are not clearly delineated, making it difficult for administrators to determine whether their current deployment includes the necessary fixes or if they remain exposed based on traditional version numbering schemes.
Mitigation strategies must address both immediate remediation and long-term security posture improvements. The primary technical fix involves implementing parameterized queries or prepared statements for all database interactions involving user input, ensuring that data is treated strictly as values rather than executable code. Input validation should also be enforced to reject unexpected characters in login fields. Given the rolling release nature of the software, administrators must consult the vendor's official documentation or changelogs directly to identify if their specific build includes the patch for this SQL injection flaw. In the interim, deploying a Web Application Firewall can provide an additional layer of defense by detecting and blocking common SQL injection patterns in HTTP requests. Regular security audits and penetration testing are recommended to verify that such vulnerabilities have been adequately addressed across all components of the application infrastructure.