Is there a public PoC exploit available for CVE-2025-12338?

Yes, a public proof-of-concept exploit is available for CVE-2025-12338. Prioritise patching immediately. EPSS: 0.0%.

Retro Basketball Shoes Online Store CVE-2025-12338

Q: What is the CVSS score of CVE-2025-12338?

CVE-2025-12338 has a CVSS 4.0 base score of 5.5 (Medium). CVSS vector: CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:L/VI:L/VA:L/SC:N/SI:N/SA:N/E:P/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X. EPSS exploitation probability: 0.0%.

MEDIUM

Improper Neutralization of Special Elements in Output Used by a Downstream Component ('Injection') (CWE-74)

2025-10-28 cna@vuldb.com

SQLi Retro Basketball Shoes Online Store Campcodes

5.5

CVSS 4.0 · NVD

Severity by source

NVD PRIMARY

5.5 MEDIUM

CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:L/VI:L/VA:L/SC:N/SI:N/SA:N/E:P/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X

vuln.today AI

6.5 MEDIUM

Network SQLi with PR:N per official vector; C:L/I:L for partial database read and data manipulation; A:N as standard SQLi does not inherently cause outright unavailability.

3.1 AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:N

4.0 AV:N/AC:L/AT:N/PR:N/UI:N/VC:L/VI:L/VA:N/SC:N/SI:N/SA:N

Primary rating from NVD.

CVSS VectorNVD

Attack Vector

Network

Attack Complexity

Low

Privileges Required

None

User Interaction

None

Scope

Lifecycle Timeline

Analysis Generated

Jul 25, 2026 - 12:07 vuln.today

CVE Published

Oct 28, 2025 - 01:16 cve.org

MEDIUM 5.5

DescriptionCVE.org

A weakness has been identified in Campcodes Retro Basketball Shoes Online Store 1.0. This vulnerability affects unknown code of the file /admin/admin_product.ph. Executing a manipulation of the argument pid can lead to sql injection. The attack may be launched remotely. The exploit has been made available to the public and could be used for attacks.

AnalysisAI

SQL injection in Campcodes Retro Basketball Shoes Online Store 1.0 exposes the /admin/admin_product.php endpoint to remote attackers who can manipulate the pid parameter to execute arbitrary SQL queries against the backend database. Publicly available exploit code exists (GitHub CVE issue #16), though the EPSS score of 0.01% at the 1st percentile signals negligible observed exploitation probability - consistent with a niche, low-footprint hobbyist application. This vulnerability is not listed in the CISA Known Exploited Vulnerabilities catalog.

Technical ContextAI

The affected component is a PHP-based e-commerce template application, Campcodes Retro Basketball Shoes Online Store 1.0 (CPE: cpe:2.3:a:campcodes:retro_basketball_shoes_online_store:1.0), distributed via campcodes.com as a source-code learning project. The root cause is CWE-74 (Improper Neutralization of Special Elements in Output Used by a Downstream Component - Injection), specifically a failure to sanitize or parameterize the pid argument before it is interpolated into a SQL query within the admin product management script. This is a classic unsanitized GET/POST parameter injection pattern common in PHP applications that construct SQL strings through direct concatenation rather than prepared statements or PDO parameterization. The /admin/admin_product.php path indicates the vulnerable logic resides in the administrative backend panel.

RemediationAI

No vendor-released patch has been identified at time of analysis. As an immediate compensating control, restrict access to /admin/admin_product.php via IP allowlisting or HTTP Basic Authentication enforced at the web server (Apache/nginx) layer - this reduces exposure but does not fix the underlying injection flaw and may add administrative overhead. Implement a WAF rule to block SQL metacharacters (single quotes, double dashes, UNION keywords) in the pid parameter; note that WAF rules can be bypassed with encoding or obfuscation and are not a permanent fix. The definitive remediation is to refactor the database query in /admin/admin_product.php to use PHP PDO prepared statements or MySQLi parameterized queries, eliminating the injection point entirely. Monitor the VulDB entry at https://vuldb.com/?id.330125 and the vendor site https://www.campcodes.com/ for any official patch release.