CVE-2025-13410
📋 TL;DR
This SQL injection vulnerability in Campcodes Retro Basketball Shoes Online Store 1.0 allows remote attackers to execute arbitrary SQL commands via the 'tid' parameter in /admin/receipt.php. This affects all users running the vulnerable software version, potentially enabling unauthorized database access and manipulation.
💻 Affected Systems
- Campcodes Retro Basketball Shoes Online Store
📦 What is this software?
⚠️ Risk & Real-World Impact
Worst Case
Complete database compromise including data theft, data manipulation, authentication bypass, and potential server takeover via SQL injection to RCE chaining.
Likely Case
Unauthorized access to sensitive data (customer information, orders, admin credentials), data manipulation, and potential privilege escalation.
If Mitigated
Limited impact with proper input validation, parameterized queries, and network segmentation in place.
🎯 Exploit Status
Exploit details are publicly available on GitHub. SQL injection via tid parameter is straightforward to exploit.
🛠️ Fix & Mitigation
✅ Official Fix
Patch Version: Unknown
Vendor Advisory: https://www.campcodes.com/
Restart Required: No
Instructions:
No official patch available. Implement workarounds or replace with secure software.
🔧 Temporary Workarounds
Input Validation Filter
allAdd input validation to sanitize the tid parameter before processing
Modify /admin/receipt.php to validate tid parameter as integer: if(!is_numeric($_GET['tid'])) { die('Invalid input'); }
Web Application Firewall Rule
allBlock SQL injection patterns targeting /admin/receipt.php
WAF rule: deny requests to /admin/receipt.php containing SQL keywords in tid parameter
🧯 If You Can't Patch
- Block external access to /admin/receipt.php via firewall rules or .htaccess
- Implement network segmentation to isolate the vulnerable system from sensitive data
🔍 How to Verify
Check if Vulnerable:
Test /admin/receipt.php?tid=1' OR '1'='1 to see if SQL error occursCheck Version:
Check software version in admin panel or configuration filesVerify Fix Applied:
Test with SQL injection payloads; successful fix should return error or no data leakage📡 Detection & Monitoring
Log Indicators:
- SQL syntax errors in web server logs
- Unusual database queries from web application
- Multiple failed parameter validation attempts
Network Indicators:
- HTTP requests to /admin/receipt.php with SQL keywords in parameters
- Unusual database traffic patterns
SIEM Query:
source="web_logs" AND uri="/admin/receipt.php" AND (param="tid" AND value MATCHES "'.*OR.*|'.*AND.*|'.*SELECT.*")