CVE-2025-12339
📋 TL;DR
This SQL injection vulnerability in Campcodes Retro Basketball Shoes Online Store 1.0 allows attackers to manipulate database queries through the /admin/admin_football.php file's pid parameter. Remote attackers can potentially access, modify, or delete database content. All installations of version 1.0 are affected.
💻 Affected Systems
- Campcodes Retro Basketball Shoes Online Store
📦 What is this software?
⚠️ Risk & Real-World Impact
Worst Case
Complete database compromise including admin credential theft, data exfiltration, and potential remote code execution via database functions.
Likely Case
Unauthorized data access, privilege escalation, and potential data manipulation or deletion.
If Mitigated
Limited impact with proper input validation and database permissions restricting damage to non-critical data.
🎯 Exploit Status
Exploit requires admin access to reach the vulnerable endpoint. The vulnerability is in an admin panel file.
🛠️ Fix & Mitigation
✅ Official Fix
Patch Version: Unknown
Vendor Advisory: https://www.campcodes.com/
Restart Required: No
Instructions:
No official patch available. Consider implementing input validation and parameterized queries in the affected PHP file.
🔧 Temporary Workarounds
Input Validation and Sanitization
allAdd input validation and sanitization for the pid parameter in admin_football.php
Modify admin_football.php to validate pid parameter as integer: if(!is_numeric($_GET['pid'])) { die('Invalid input'); }
Web Application Firewall (WAF)
allDeploy WAF rules to block SQL injection patterns targeting the admin_football.php endpoint
Add WAF rule: Block requests to /admin/admin_football.php with SQL injection patterns in parameters
🧯 If You Can't Patch
- Restrict access to /admin/ directory to trusted IP addresses only
- Implement database user with minimal required permissions (read-only if possible)
🔍 How to Verify
Check if Vulnerable:
Check if /admin/admin_football.php exists and accepts pid parameter without proper validationCheck Version:
Check application version in configuration files or admin panelVerify Fix Applied:
Test with SQL injection payloads (e.g., pid=1' OR '1'='1) and verify they are rejected📡 Detection & Monitoring
Log Indicators:
- Unusual SQL queries in database logs
- Multiple failed login attempts to admin panel
- Requests to admin_football.php with suspicious pid values
Network Indicators:
- HTTP requests to /admin/admin_football.php with SQL keywords in parameters
- Unusual database traffic from web server
SIEM Query:
source="web_logs" AND uri="/admin/admin_football.php" AND (param="pid" AND value MATCHES "[';]|UNION|SELECT|INSERT|UPDATE|DELETE")