Is there a public PoC exploit available for CVE-2025-12336?

Yes, a public proof-of-concept exploit is available for CVE-2025-12336. Prioritise patching immediately. EPSS: 0.0%.

Retro Basketball Store CVE-2025-12336

Q: What is the CVSS score of CVE-2025-12336?

CVE-2025-12336 has a CVSS 4.0 base score of 5.5 (Medium). CVSS vector: CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:L/VI:L/VA:L/SC:N/SI:N/SA:N/E:P/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X. EPSS exploitation probability: 0.0%.

MEDIUM

Improper Neutralization of Special Elements in Output Used by a Downstream Component ('Injection') (CWE-74)

2025-10-28 cna@vuldb.com

PHP SQLi Retro Basketball Shoes Online Store Campcodes

5.5

CVSS 4.0 · NVD

Severity by source

NVD PRIMARY

5.5 MEDIUM

CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:L/VI:L/VA:L/SC:N/SI:N/SA:N/E:P/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X

vuln.today AI

7.3 HIGH

Network-accessible admin endpoint requires no authentication (PR:N, AV:N); limited CIA impact consistent with constrained SQL injection in a low-footprint PHP application.

3.1 AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:L

4.0 AV:N/AC:L/AT:N/PR:N/UI:N/VC:L/VI:L/VA:L/SC:N/SI:N/SA:N

Primary rating from NVD.

CVSS VectorNVD

Attack Vector

Network

Attack Complexity

Low

Privileges Required

None

User Interaction

None

Scope

Lifecycle Timeline

Analysis Generated

Jul 25, 2026 - 12:08 vuln.today

CVE Published

Oct 28, 2025 - 01:16 cve.org

MEDIUM 5.5

DescriptionCVE.org

A vulnerability was identified in Campcodes Retro Basketball Shoes Online Store 1.0. Affected by this issue is some unknown functionality of the file /admin/admin_index.php. Such manipulation of the argument Username leads to sql injection. The attack can be launched remotely. The exploit is publicly available and might be used.

AnalysisAI

SQL injection in Campcodes Retro Basketball Shoes Online Store 1.0 exposes the admin login endpoint to remote, unauthenticated database manipulation via the Username parameter in /admin/admin_index.php. The CVSS 4.0 vector (AV:N/AC:L/PR:N/UI:N) confirms exploitation requires no authentication and minimal skill, and a public proof-of-concept exists on GitHub. Despite this, real-world risk is curtailed by the product's extremely niche deployment footprint, an EPSS of just 0.01% (1st percentile), and absence from CISA KEV - making mass exploitation implausible.

Technical ContextAI

The affected component is the PHP-based admin authentication page (/admin/admin_index.php) of Campcodes Retro Basketball Shoes Online Store version 1.0 (CPE: cpe:2.3:a:campcodes:retro_basketball_shoes_online_store:1.0:*:*:*:*:*:*:*). The root cause is CWE-74 (Improper Neutralization of Special Elements in Output Used by a Downstream Component - 'Injection'), a broad class covering SQL injection arising when user-supplied input is concatenated directly into SQL query strings without parameterization or sanitization. This is a textbook unsanitized-PHP-input-to-SQL pattern, where the Username field value is interpolated into a login query, enabling an attacker to alter query logic. The Campcodes platform is a PHP-based open-source e-commerce demo commonly used in student and tutorial contexts.

RemediationAI

No vendor-released patch has been identified at time of analysis; Campcodes has not published a security advisory for this issue. As an immediate compensating control, network access to /admin/admin_index.php should be restricted at the web server (e.g., Apache/Nginx IP allowlist) or perimeter firewall to trusted IP ranges only - this eliminates the network-reachable attack surface entirely, at the trade-off of preventing legitimate remote admin access. If internet-facing access is required, deploying a WAF with SQL injection ruleset (e.g., ModSecurity with OWASP CRS) can reduce exploitation likelihood, though determined attackers may bypass WAF rules with obfuscated payloads. The definitive fix requires refactoring the Username parameter handling in /admin/admin_index.php to use PHP PDO prepared statements or parameterized queries, removing the injection surface at the code level. Refer to vuldb.com/?id.330123 for additional context.