This vulnerability involves SQL injection via the id/password parameters in an unspecified function of index.php in the Admin Login Handler component of Abdurrab5 online-makeup-store. The flaw allows remote attackers to inject SQL commands by manipulating these arguments. The product's rolling release model means no explicit versioning information is provided for affected or fixed releases. Public exploit code exists, but no confirmed in-the-wild exploitation is reported. No vendor patch or remediation details have been provided.

Successful exploitation of this vulnerability could allow remote attackers to execute arbitrary SQL commands on the backend database with low complexity and no privileges required. This may lead to partial compromise of data confidentiality, integrity, and availability, as indicated by the CVSS vector showing low impact on confidentiality, integrity, and availability. However, no confirmed active exploitation in the wild is reported.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Since the vendor has not provided patch or fix information and the product uses a rolling release model, monitor official Abdurrab5 channels for updates. Until a fix is available, consider applying web application firewall rules to detect and block SQL injection attempts targeting the id/password parameters.