A remote vulnerability exists in the Admin Login handler of Abdurrab5 online‑makeup‑store. Modifying the id or password parameters in index.php allows an attacker to inject arbitrary SQL statements. The resulting injection can read, modify, or delete data in the database, and may enable further credential or privilege escalation. The weakness arises from improper input parsing and lack of parameterized queries (CWE‑74 and CWE‑89).

The flaw affects the Abdurrab5 online‑makeup‑store, specifically the admin login component (index.php). Because the product uses a rolling release model, specific version numbers for affected or patched releases are not provided.

The CVSS score of 6.9 indicates moderate severity, and the exploit is publicly disclosed and can be triggered remotely. No EPSS score is available and the vulnerability is not listed in the CISA KEV catalog, but the public availability of an exploit combined with the remote nature raises the likelihood of real‑world attacks. Attackers can exploit the SQL injection by supplying crafted id or password values to the admin login page, potentially gaining unauthorized database access. No authentication or network isolation limitations are mentioned, so the risk remains significant when the admin interface is exposed to the internet.