EUVD-2026-85674
GHSA-cqrp-53g7-w3w8
Attack ChainAIDerived
Hypothetical attack flow derived from CVE metadata – not a confirmed exploit chain
-
AccessReach index.php admin login remotely
-
ExploitInject SQL via id/password parameter
-
ExecutionBypass authentication or extract DB
-
ImpactDump admin credentials and store data
Vulnerability Assessment
| Weakness |
CWE
OWASP Top 10:2025
A05:2025 - Injection
ASVS 5.0
V1 - Encoding and Sanitization Parameterized queries, prepared statements
MITRE ATT&CK
2 techniques across 2 tactics: Initial Access, Persistence The technique list with ATT&CK links and the kill-chain view is part of the Basic plan and up. |
| Exploitation Conditions | Exploitation requires only network reachability to the application's index.php Admin Login Handler; the injectable 'id'/'password' parameters are exposed on the unauthenticated login endpoint itself, so no credentials, user interaction, or non-default configuration are needed (AV:N/AC:L/PR:N/UI:N). The primary practical limiter is deployment scarcity: this is an individual developer's 'online-makeup-store' PHP project with no versioned releases and negligible production presence, so few if any real targets exist. Any instance running the vulnerable index.php on a reachable web server is exploitable. |
| Impact | The provided CVSS 4.0 vector (AV:N/AC:L/AT:N/PR:N/UI:N) describes a remotely reachable, low-complexity, unauthenticated SQL injection, but the vendor-assigned impact metrics (VC:L/VI:L/VA:L, base 6.9) are conservative for a login-handler SQLi. In practice, an injectable admin-login query typically permits authentication bypass and full database extraction, so I assess confidentiality/integrity impact as HIGHER than the input's uniform 'Low' - the 6.9 likely understates technical impact while overstating real-world urgency. The E:P value and the GitHub writeup confirm publicly available exploit code exists, but this is NOT active exploitation: there is no CISA KEV listing and no EPSS score in the input. This is a VulDB-style mass-disclosure of an obscure hobby project ('Abdurrab5/online-makeup-store', rolling release, no versioned releases), so despite a network/unauthenticated vector the real-world footprint is negligible. Net: technically a genuine pre-auth SQLi with public POC, but low priority due to near-zero deployment - not a widespread-exploitation threat. |
| Exploit ScenarioDerived | A remote, unauthenticated attacker sends a crafted 'id' or 'password' parameter to index.php's Admin Login Handler, injecting SQL that bypasses authentication and/or dumps administrator credentials and store data from the backend database. A public proof-of-concept writeup exists on GitHub (yashkeral/cve-writeups), lowering the skill required. Because the vector is AV:N/AC:L/PR:N/UI:N, no prior access, user interaction, or special timing is needed. |
Get an e-mail when this CVE is exploited, patched or re-scored. Free account.
Alert meAnalysisAIv1 – Sep 23, 2026
Unauthenticated SQL injection in the Online Makeup Store PHP application lets remote attackers manipulate the 'id' and 'password' parameters of index.php's Admin Login Handler. Because the injectable parameters sit on the public login endpoint, no credentials, user interaction, or special configuration are required, and publicly available exploit code exists (no CISA KEV listing). Practical risk is dominated by deployment scarcity: this is an individual developer's project with no versioned releases and negligible production footprint, so few real targets are likely to exist even though any reachable instance is exploitable.
RemediationAI
No vendor-released patch has been identified at time of analysis, and because the project is a rolling-release PHP application with no version tags, there is no fixed version to cite; the vendor was contacted early about the disclosure but no patch artifact is referenced in the available intelligence. Until a fix ships, the most effective control is to remediate the code directly by converting the Admin Login Handler's SQL query to parameterized statements or prepared statements for the 'id' and 'password' inputs, which eliminates the injection class entirely. Where code changes are not feasible, restrict network access to the login endpoint using IP allowlisting, HTTP authentication, or a reverse proxy, accepting the trade-off that legitimate remote administrators lose direct access. A WAF rule targeting SQL metacharacters in login parameters can provide interim protection but is bypassable and must not be treated as a permanent fix. Finally, if any instance has been internet-exposed, assume credential and database compromise and rotate all administrative passwords and database secrets. Reference material, including a public write-up at https://github.com/yashkeral/cve-writeups/blob/main/online-makeup-store/01-admin-login-sqli.md, should be used to reproduce and verify the fix.
Affected VersionsENISA
Affects your stack
Find out whether the stacks and servers you run are on an affected version.
Checking this CVE against your own stacks and servers is part of the Basic plan and up.
Technical ContextAI · show details
The affected component is the Admin Login Handler in index.php of Abdurrab5's 'online-makeup-store', a PHP web application (CPE cpe:2.3:a:abdurrab5:online-makeup-store:*:*:*:*:*:*:*:*). The root cause is CWE-89 (SQL Injection): user-supplied values for the 'id' and 'password' parameters are incorporated into a SQL query without proper parameterization or escaping, allowing an attacker to alter query semantics. The vulnerability is remotely reachable over the network at low complexity against the unauthenticated login form. The vendor-assigned CVSS 4.0 vector (AV:N/AC:L/AT:N/PR:N/UI:N/VC:L/VI:L/VA:L) scores 6.9, while the independent assessment's CVSS 3.1 vector (AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:L/A:N) treats confidentiality impact as high, which is plausible for a login-handler injection that may permit authentication bypass or extraction of stored credentials and table data. The project uses a rolling release model, so no discrete version boundaries exist to scope affected builds.
Know when PHP gets its next vulnerability
- Watch products and get an email when something new is published
- Check this CVE against your own stack and servers
- Exploit and PoC references, threat intelligence from 22 sources
No credit card · 7-day full trial
Severity by source
CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:L/VI:L/VA:L/SC:N/SI:N/SA:N/E:P
Unauthenticated remote SQLi on the login endpoint (AV:N/AC:L/PR:N/UI:N); login-handler injection enables full DB read (C:H) and auth bypass/limited write (I:L), no availability impact.
Primary rating from Vendor (VulDB).
CVSS VectorVendor: VulDB
Lifecycle Timeline
2DescriptionCVE.org
A vulnerability was detected in Abdurrab5 online-makeup-store. This affects an unknown function of the file index.php of the component Admin Login Handler. The manipulation of the argument id/password results in sql injection. The attack can be executed remotely. The exploit is now public and may be used. This product implements a rolling release for ongoing delivery, which means version information for affected or updated releases is unavailable. The vendor was contacted early about this disclosure.
Threat Intelligence Overview
NVD
CVE.org
EPSS
Vulnrichment
VulDB
How this decision was reached
The engine reads each signal below and applies a fixed list of rules from top to bottom. The first rule that matches sets the recommended action – like a statement, every line is shown.
What every action level means
SSVC AssessmentENISA
Priority Score
Attack Technique
SQL injection exploits the way applications construct database queries by mixing user input directly into SQL statements.
In PHP versions 7.1.x below 7.1.33, 7.2.x below 7.2.24 and 7.3.x below 7.3.11 in certain configurations of FPM setup it
sapi/cgi/cgi_main.c in PHP before 5.3.12 and 5.4.x before 5.4.2, when configured as a CGI script (aka php-cgi), does not
(1) boardData102.php, (2) boardData103.php, (3) boardDataJP.php, (4) boardDataNA.php, and (5) boardDataWW.php in Netgear
The '/common/download_agent_installer.php' script in the Quest KACE System Management Appliance 8.0.318 is accessible by
ProjectSend versions prior to r1720 are affected by an improper authentication vulnerability. Rated critical severity (C
Roundcube Webmail contains a critical PHP object deserialization vulnerability (CVE-2025-49113, CVSS 9.9) that allows au
Util/PHP/eval-stdin.php in PHPUnit before 4.8.28 and 5.x before 5.6.3 allows remote attackers to execute arbitrary PHP c
Palo Alto Networks PAN-OS management web interface contains an authentication bypass allowing unauthenticated attackers
Nagios XI version xi-5.7.5 is affected by OS command injection. Rated high severity (CVSS 8.8), this vulnerability is re
Nagios XI version xi-5.7.5 is affected by OS command injection. Rated high severity (CVSS 8.8), this vulnerability is re
The get_referers function in /opt/ws/bin/sblistpack in Sophos Web Appliance before 3.7.9.1 and 3.8 before 3.8.1.1 allows
The Backup Migration plugin for WordPress is vulnerable to Remote Code Execution in all versions up to, and including, 1
Exploit-DB