Retro Basketball Shoes CVE-2025-12339
MEDIUMSeverity by source
CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:L/VI:L/VA:L/SC:N/SI:N/SA:N/E:P/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X
Network-accessible SQLi with no auth per the CVSS 4.0 PR:N vector; limited C/I/A impact reflects partial database read and write access without full system compromise.
Primary rating from NVD.
CVSS VectorNVD
Lifecycle Timeline
2DescriptionCVE.org
A security vulnerability has been detected in Campcodes Retro Basketball Shoes Online Store 1.0. This issue affects some unknown processing of the file /admin/admin_football.php. The manipulation of the argument pid leads to sql injection. Remote exploitation of the attack is possible. The exploit has been disclosed publicly and may be used.
AnalysisAI
SQL injection in Campcodes Retro Basketball Shoes Online Store 1.0 exposes the /admin/admin_football.php endpoint to database manipulation via the unsanitized pid parameter, achievable by remote unauthenticated attackers per the CVSS 4.0 PR:N rating. The flaw enables limited read, write, and availability impact against the backend database. A public proof-of-concept exploit has been disclosed via GitHub, though EPSS remains extremely low at 0.03% (8th percentile), consistent with this product's negligible real-world deployment footprint and no CISA KEV listing.
Technical ContextAI
The affected product is a PHP-based e-commerce demo application identified by CPE cpe:2.3:a:campcodes:retro_basketball_shoes_online_store:1.0, distributed by Campcodes as an educational script. The vulnerability is classified under CWE-74 (Improper Neutralization of Special Elements in Output Used by a Downstream Component - Injection), with SQL injection as the specific manifestation. The pid parameter in /admin/admin_football.php is passed directly into a database query without sanitization or parameterization, allowing an attacker to alter query logic. Campcodes scripts typically use a PHP/MySQL stack with minimal input validation, and the CVSS 4.0 PR:N rating implies the admin panel itself lacks enforced authentication controls.
RemediationAI
No vendor-released patch has been identified at the time of analysis; this product is an educational PHP demo script with no formal security patching cadence. The primary remediation is to avoid deploying this application in any internet-accessible or production environment entirely. If the application must remain operational, implement server-level access controls on the /admin/ directory using HTTP Basic Auth or IP allowlisting via Apache .htaccess or nginx allow/deny directives, which removes the PR:N attack surface. Additionally, apply WAF rules to block SQL metacharacters (single quotes, UNION, SELECT, etc.) in the pid parameter - note this is a compensating control only and does not address the root cause. The permanent fix is to refactor the affected query to use PHP PDO or MySQLi prepared statements with parameterized inputs. References: exploit disclosure at https://github.com/HYLCXH/CVE/issues/17; VulDB entry at https://vuldb.com/?id.330126.
In PHP versions 7.1.x below 7.1.33, 7.2.x below 7.2.24 and 7.3.x below 7.3.11 in certain configurations of FPM setup it
sapi/cgi/cgi_main.c in PHP before 5.3.12 and 5.4.x before 5.4.2, when configured as a CGI script (aka php-cgi), does not
(1) boardData102.php, (2) boardData103.php, (3) boardDataJP.php, (4) boardDataNA.php, and (5) boardDataWW.php in Netgear
The '/common/download_agent_installer.php' script in the Quest KACE System Management Appliance 8.0.318 is accessible by
ProjectSend versions prior to r1720 are affected by an improper authentication vulnerability. Rated critical severity (C
Roundcube Webmail contains a critical PHP object deserialization vulnerability (CVE-2025-49113, CVSS 9.9) that allows au
Util/PHP/eval-stdin.php in PHPUnit before 4.8.28 and 5.x before 5.6.3 allows remote attackers to execute arbitrary PHP c
Palo Alto Networks PAN-OS management web interface contains an authentication bypass allowing unauthenticated attackers
Nagios XI version xi-5.7.5 is affected by OS command injection. Rated high severity (CVSS 8.8), this vulnerability is re
Nagios XI version xi-5.7.5 is affected by OS command injection. Rated high severity (CVSS 8.8), this vulnerability is re
The get_referers function in /opt/ws/bin/sblistpack in Sophos Web Appliance before 3.7.9.1 and 3.8 before 3.8.1.1 allows
The Backup Migration plugin for WordPress is vulnerable to Remote Code Execution in all versions up to, and including, 1
Share
External POC / Exploit Code
Leaving vuln.today