The vulnerability resides in the customerSignin.php script of the Abdurrab5 online‑makeup‑store application. By manipulating the username or password fields, an attacker can inject arbitrary SQL statements into the query that authenticates users. This flaw is a classic SQL injection that can expose, modify, or delete data stored in the database, and could also allow an attacker to gain elevated privileges within the application or the underlying database server.

The affected product is Abdurrab5's online‑makeup‑store web application. Because the vendor uses a rolling release strategy, specific version numbers are not provided in the advisory, and all current releases could be impacted until a fix is released.

The CVSS score of 6.9 indicates moderate severity. No EPSS score is available, and the vulnerability is not listed in the CISA KEV catalog. The attack vector is remote; the SQL injection can be triggered from any external request that supplies crafted credentials to the login form. If exploited, the attacker could read or modify sensitive customer data or disrupt the login functionality, thereby compromising the confidentiality, integrity, or availability of the application.