This vulnerability involves SQL injection via manipulation of username or password arguments in the customerSignin.php file of Abdurrab5's online-makeup-store Customer Login Handler component. The attack can be performed remotely without authentication. The product uses a rolling release model, so no explicit affected or fixed versions are identified. Exploit code is publicly available, increasing the risk of exploitation. The CVSS 4.0 base score is 6.9, indicating medium severity.

Successful exploitation could allow an attacker to execute arbitrary SQL commands on the backend database, potentially leading to unauthorized data access or modification. The vulnerability is remotely exploitable without privileges or user interaction, increasing its risk. However, the CVSS vector indicates low to limited impact on confidentiality, integrity, and availability.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Since the product uses a rolling release strategy, monitor official Abdurrab5 communications for updates or fixes. Until a fix is available, consider implementing web application firewall (WAF) rules to detect and block SQL injection attempts targeting the customerSignin.php endpoint.