CVE-2025-13411
📋 TL;DR
This vulnerability in Campcodes Retro Basketball Shoes Online Store 1.0 allows attackers to upload arbitrary files to the server via the product_image parameter in /admin/admin_football.php. This affects all installations of the software that have the vulnerable file accessible. Remote attackers can potentially upload malicious files like web shells to gain unauthorized access.
💻 Affected Systems
- Campcodes Retro Basketball Shoes Online Store
📦 What is this software?
⚠️ Risk & Real-World Impact
Worst Case
Complete system compromise through web shell upload leading to data theft, defacement, or ransomware deployment
Likely Case
Unauthorized file upload allowing web shell installation and subsequent server access
If Mitigated
File upload blocked or sanitized, preventing malicious file execution
🎯 Exploit Status
Exploit details are publicly available on GitHub
🛠️ Fix & Mitigation
✅ Official Fix
Patch Version: Unknown
Vendor Advisory: https://www.campcodes.com/
Restart Required: No
Instructions:
No official patch available. Consider workarounds or alternative software.
🔧 Temporary Workarounds
Restrict admin access
allBlock access to /admin/admin_football.php file
# Apache: Add to .htaccess
<Files "admin_football.php">
Order Deny,Allow
Deny from all
</Files>
# Nginx: Add to server block
location ~ /admin/admin_football\.php$ {
deny all;
return 403;
}
Implement file upload validation
allAdd server-side validation for file uploads
# PHP example for file validation
$allowed_types = ['image/jpeg', 'image/png', 'image/gif'];
$max_size = 2097152; // 2MB
if (!in_array($_FILES['product_image']['type'], $allowed_types) ||
$_FILES['product_image']['size'] > $max_size) {
die('Invalid file');
}
🧯 If You Can't Patch
- Implement web application firewall (WAF) rules to block file uploads to vulnerable endpoint
- Monitor file system for unauthorized file creation in upload directories
🔍 How to Verify
Check if Vulnerable:
Attempt to upload a non-image file via /admin/admin_football.php product_image parameterCheck Version:
Check software version in admin panel or configuration filesVerify Fix Applied:
Test that file upload restrictions are properly enforced and only allowed file types are accepted📡 Detection & Monitoring
Log Indicators:
- File upload attempts to /admin/admin_football.php
- Unusual file creations in upload directories
- POST requests with file uploads to admin endpoints
Network Indicators:
- HTTP POST requests to /admin/admin_football.php with multipart/form-data
- Unusual outbound connections from web server
SIEM Query:
source="web_logs" AND uri="/admin/admin_football.php" AND method="POST" AND content_type="multipart/form-data"