CVE-2026-96601: Online Makeup Store SQL Injection Flaw

CVE-2026-96601 Overview

CVE-2026-96601 is a SQL injection vulnerability in the Abdurrab5 online-makeup-store application. The flaw resides in the Admin Login Handler implemented in index.php, where the id and password parameters are not properly sanitized before being incorporated into a SQL query. Remote attackers can manipulate these parameters to inject arbitrary SQL statements without authentication. A public exploit writeup exists, and the vendor was notified prior to disclosure. Because the project follows a rolling release model, no specific fixed version is available.

Critical Impact
Unauthenticated remote attackers can inject SQL through the admin login form, potentially bypassing authentication and accessing or altering backend database contents.

Affected Products

Abdurrab5 online-makeup-store (rolling release)
Component: Admin Login Handler in index.php
Parameters: id and password

Discovery Timeline

2026-09-23 - CVE-2026-96601 published to NVD
2026-09-23 - Last updated in NVD database

Technical Details for CVE-2026-96601

Vulnerability Analysis

The vulnerability is a SQL injection [CWE-74: Improper Neutralization of Special Elements in Output Used by a Downstream Component] affecting the administrative login flow of the online-makeup-store PHP application. The index.php script accepts the id and password fields from an HTTP POST request submitted through the admin login form. These values are concatenated directly into a SQL statement executed against the backing database.

Because user-supplied input reaches the SQL interpreter without parameterization or escaping, attackers can alter the query structure. Successful exploitation may enable authentication bypass, extraction of stored administrative credentials, or read and write access to arbitrary database records. The attack requires no privileges and no user interaction, and it can be executed remotely across the network.

Root Cause

The root cause is the direct interpolation of untrusted request parameters into a dynamically constructed SQL query. The Admin Login Handler does not use prepared statements, parameter binding, or an allow-list validation routine for the id and password inputs. Any special SQL metacharacters submitted through the login form are treated as query syntax rather than data.

Attack Vector

The attack vector is network-based over HTTP. An unauthenticated attacker submits a crafted POST request to the admin login endpoint served by index.php. By injecting SQL payloads into the id or password field, the attacker rewrites the intended WHERE clause. Classic authentication-bypass payloads or UNION-based extraction techniques can be used against the vulnerable query. See the GitHub SQLi Writeup for the published proof-of-concept details.

Detection Methods for CVE-2026-96601

Indicators of Compromise

POST requests to /index.php containing SQL metacharacters such as ', --, #, UNION, OR 1=1, or SLEEP( in the id or password fields.
Successful admin sessions established without a preceding legitimate credential validation event in application logs.
Unexpected database errors, long-running queries, or spikes in query volume originating from the login endpoint.

Detection Strategies

Deploy web application firewall (WAF) signatures targeting SQL injection patterns on the admin login path.
Enable verbose query logging on the backing database and alert on syntactically anomalous statements referencing admin or user tables.
Correlate authentication events in the application against corresponding database SELECT queries to identify bypass attempts.

Monitoring Recommendations

Monitor HTTP access logs for repeated failed logins followed by a successful admin session from the same source address.
Track outbound traffic from the web server to detect data exfiltration following suspected exploitation.
Alert on new administrator accounts, privilege changes, or modifications to product and order records outside change windows.

How to Mitigate CVE-2026-96601

Immediate Actions Required

Restrict network access to the administrative interface using IP allow-lists, VPN, or reverse-proxy authentication.
Deploy WAF rules that block SQL injection payloads targeting the id and password parameters on index.php.
Review database and application logs for prior exploitation attempts and rotate all administrator credentials.

Patch Information

No vendor-issued fixed version is available because the project uses a rolling release model. Operators should pull the latest upstream commits from the project repository and verify that the Admin Login Handler uses parameterized queries. Refer to the VulDB entry for CVE-2026-96601 for continued tracking of remediation status.

Workarounds

Replace concatenated SQL in the login handler with prepared statements using PDO or mysqli parameter binding.
Enforce strict server-side input validation on the id field, permitting only expected character classes and length.
Apply the principle of least privilege to the database account used by the application, removing DDL and administrative rights.

bash

# Example: convert vulnerable query to a prepared statement (PHP PDO)
$stmt = $pdo->prepare('SELECT id FROM admin WHERE username = :u AND password = :p');
$stmt->execute([':u' => $_POST['id'], ':p' => hash('sha256', $_POST['password'])]);
$row = $stmt->fetch(PDO::FETCH_ASSOC);