CVE-2026-96602: Online Makeup Store SQL Injection Vulnerability

CVE-2026-96602 Overview

CVE-2026-96602 is a SQL injection vulnerability in the Abdurrab5 online-makeup-store application. The flaw resides in the Customer Login Handler component, specifically within the customerSignin.php file. Attackers can manipulate the username and password parameters to inject arbitrary SQL statements. The issue is remotely exploitable and requires no authentication or user interaction. A public exploit has been published, increasing the risk of opportunistic attacks. Because the project follows a rolling release strategy, no fixed version identifier is available for affected or patched builds.

Critical Impact
Unauthenticated remote attackers can inject SQL into the customer login flow, potentially exposing credentials and customer data stored in the backend database.

Affected Products

Abdurrab5 online-makeup-store (rolling release)
Component: Customer Login Handler (customerSignin.php)
Parameters: username and password

Discovery Timeline

2026-09-23 - CVE-2026-96602 published to the National Vulnerability Database (NVD)
2026-09-23 - Last updated in NVD database

Technical Details for CVE-2026-96602

Vulnerability Analysis

The vulnerability is a SQL injection flaw classified under CWE-74: Improper Neutralization of Special Elements in Output Used by a Downstream Component. The customerSignin.php script processes login submissions without properly sanitizing the username and password parameters. Attacker-controlled input is concatenated directly into a SQL query executed against the application database. This allows adversaries to alter the intended query logic, bypass authentication, or extract data from arbitrary tables. Because the login endpoint is reachable pre-authentication, exploitation requires only network access to the web application.

Root Cause

The root cause is missing input validation and the absence of parameterized queries in the customer login handler. User-supplied credential fields are trusted and interpolated into SQL statements without prepared statement bindings or escaping. Any special SQL metacharacter in the request body is executed as part of the query.

Attack Vector

An attacker submits a crafted POST request to the login endpoint containing SQL payloads in the username or password field. Typical payloads include tautology-based authentication bypasses (for example, appending OR '1'='1'-- style constructs) and UNION-based data extraction. The attack requires no credentials, no user interaction, and can be automated at scale. See the GitHub CVE writeup for the published proof-of-concept walkthrough.

No verified exploit code is reproduced here. Refer to the public writeup for technical
details on the SQL injection payloads targeting the username/password parameters in
customerSignin.php.

Detection Methods for CVE-2026-96602

Indicators of Compromise

POST requests to customerSignin.php containing SQL metacharacters such as ', --, #, UNION, OR 1=1, or SLEEP( in the username or password fields.
Repeated failed login attempts followed by successful authentication using unusual credential strings.
Database error messages returned in HTTP responses referencing MySQL, syntax errors, or table names.
Anomalous outbound queries or large result sets originating from the web application database user.

Detection Strategies

Deploy web application firewall (WAF) rules that match SQL injection signatures against POST bodies submitted to authentication endpoints.
Enable database query logging and alert on queries containing tautologies, UNION SELECT constructs, or comment terminators from the application user account.
Correlate web server access logs with database audit logs to identify malformed queries originating from login requests.

Monitoring Recommendations

Monitor authentication endpoints for high-frequency requests from a single source containing encoded SQL characters (%27, %3B, %2D%2D).
Track HTTP 500 responses from customerSignin.php, which often indicate injection attempts triggering SQL syntax errors.
Baseline normal login request patterns and alert on payload length or character-set anomalies in credential fields.

How to Mitigate CVE-2026-96602

Immediate Actions Required

Restrict public access to customerSignin.php behind a WAF configured with SQL injection rulesets until a code-level fix is deployed.
Rewrite the affected login query to use parameterized prepared statements via PDO or MySQLi with bound parameters.
Rotate database credentials and audit the application database account privileges, applying least-privilege principles.
Review database and web access logs for prior exploitation attempts and evidence of data exfiltration.

Patch Information

The vendor uses a rolling release strategy, so no discrete patched version is published. Administrators should pull the latest commits from the upstream repository and manually validate that customerSignin.php uses parameterized queries. Consult the VulDB entry for CVE-2026-96602 for updates on remediation status.

Workarounds

Place the application behind a reverse proxy enforcing input validation and SQL injection filtering on the login endpoint.
Implement server-side input validation that rejects credential values containing SQL metacharacters or exceeding expected length.
Enforce database user permissions limited to SELECT, INSERT, and UPDATE on required tables only, blocking UNION access to sensitive schemas where possible.
Enable multi-factor authentication or CAPTCHA on the login flow to slow automated exploitation.

bash

# Example Apache mod_security rule to block common SQLi payloads on the login endpoint
SecRule REQUEST_URI "@endsWith /customerSignin.php" \
  "id:1009001,phase:2,deny,status:403,log,msg:'Potential SQLi on customer login',\
  chain"
  SecRule ARGS:username|ARGS:password "@rx (?i)(union(\s|\+)+select|or\s+1=1|--|#|sleep\()" \
    "t:none,t:urlDecodeUni"