Online Makeup Store
Monthly
Missing authorization in the Abdurrab5 Online Makeup Store PHP application allows unauthenticated remote attackers to reach admin-only functionality by supplying a crafted adminid argument to the confirm_logged_in/confirm_user functions in functions.php, enabling low-impact confidentiality, integrity, and availability effects. Publicly available exploit code exists-including a GitHub write-up-but no CISA KEV confirmation or EPSS data is provided, so active exploitation is not confirmed. The vendor uses a rolling release with no version metadata, meaning all deployments of this codebase should be considered potentially affected, though the project's niche, single-developer nature limits its real-world attack surface.
Remote unauthenticated SQL injection in the Abdurrab5 'online-makeup-store' customer login handler (customerSignin.php) allows attackers to inject arbitrary SQL via the username or password arguments, potentially leading to full database compromise with high confidentiality and integrity impact. The flaw is confirmed by a publicly available exploit write-up on GitHub, and the CVSS 4.0 vector carries the E:P proof-of-concept maturity flag, though exploitation in production is expected to be rare due to the niche deployment footprint of this individual-developer application. No vendor patch is available at time of analysis, and the project uses a rolling release model, so no fixed version can be identified.
Unauthenticated SQL injection in the Online Makeup Store PHP application lets remote attackers manipulate the 'id' and 'password' parameters of index.php's Admin Login Handler. Because the injectable parameters sit on the public login endpoint, no credentials, user interaction, or special configuration are required, and publicly available exploit code exists (no CISA KEV listing). Practical risk is dominated by deployment scarcity: this is an individual developer's project with no versioned releases and negligible production footprint, so few real targets are likely to exist even though any reachable instance is exploitable.
Missing authorization in the Abdurrab5 Online Makeup Store PHP application allows unauthenticated remote attackers to reach admin-only functionality by supplying a crafted adminid argument to the confirm_logged_in/confirm_user functions in functions.php, enabling low-impact confidentiality, integrity, and availability effects. Publicly available exploit code exists-including a GitHub write-up-but no CISA KEV confirmation or EPSS data is provided, so active exploitation is not confirmed. The vendor uses a rolling release with no version metadata, meaning all deployments of this codebase should be considered potentially affected, though the project's niche, single-developer nature limits its real-world attack surface.
Remote unauthenticated SQL injection in the Abdurrab5 'online-makeup-store' customer login handler (customerSignin.php) allows attackers to inject arbitrary SQL via the username or password arguments, potentially leading to full database compromise with high confidentiality and integrity impact. The flaw is confirmed by a publicly available exploit write-up on GitHub, and the CVSS 4.0 vector carries the E:P proof-of-concept maturity flag, though exploitation in production is expected to be rare due to the niche deployment footprint of this individual-developer application. No vendor patch is available at time of analysis, and the project uses a rolling release model, so no fixed version can be identified.
Unauthenticated SQL injection in the Online Makeup Store PHP application lets remote attackers manipulate the 'id' and 'password' parameters of index.php's Admin Login Handler. Because the injectable parameters sit on the public login endpoint, no credentials, user interaction, or special configuration are required, and publicly available exploit code exists (no CISA KEV listing). Practical risk is dominated by deployment scarcity: this is an individual developer's project with no versioned releases and negligible production footprint, so few real targets are likely to exist even though any reachable instance is exploitable.