online-makeup-store CVE-2026-96602

Requires a network-reachable deployment of Abdurrab5 'online-makeup-store' with the customerSignin.php Customer Login Handler exposed - which is the default, pre-authentication login endpoint. No authentication, no user interaction, and no non-default configuration are needed; the attacker simply supplies malicious input in the username or password argument. The primary limiting factor is deployment scarcity: this is a niche individual-developer application, so exploitable instances in production are expected to be very few. No specific platform or version gating applies because the project ships as a rolling release.

The CVSS 4.0 vector (AV:N/AC:L/AT:N/PR:N/UI:N) describes a trivially reachable, remote, unauthenticated SQL injection, and the E:P (Proof-of-Concept) exploit-maturity flag aligns with the confirmed public write-up on GitHub. However, the vendor/VulDB score of 6.9 is driven entirely by uniformly LOW impact metrics (VC:L/VI:L/VA:L), which is inconsistent with a login-handler SQL injection where the attacker controls the username/password arguments - such flaws typically enable authentication bypass and full database extraction/modification (CWE-89), warranting HIGH confidentiality and integrity. This is a genuine, low-effort exploitation primitive (POC published), but the real-world risk is sharply bounded by prevalence: 'online-makeup-store' by Abdurrab5 is an obscure open-source project with no meaningful production footprint. No CISA KEV listing and no EPSS score are provided; treat this as opportunistic/scanner-bait rather than a targeted-exploitation priority. Key conflict to verify: the assigned LOW impact metrics understate the typical read/write capability of unauthenticated SQLi - verify actual data exposure against the source.

A remote, unauthenticated attacker sends a crafted username or password parameter to customerSignin.php containing SQL metacharacters, injecting into the login query to bypass authentication or dump the customer database. A public proof-of-concept write-up exists on GitHub (yashkeral/cve-writeups), lowering the skill required. Because the endpoint is the pre-authentication login handler, no credentials or user interaction are needed.