CVE-2025-14219
📋 TL;DR
Campcodes Retro Basketball Shoes Online Store 1.0 has an unrestricted file upload vulnerability in the admin/admin_running.php file. Attackers can remotely upload malicious files by manipulating the product_image parameter, potentially leading to server compromise. This affects all deployments of version 1.0 with the vulnerable file accessible.
💻 Affected Systems
- Campcodes Retro Basketball Shoes Online Store
📦 What is this software?
⚠️ Risk & Real-World Impact
Worst Case
Remote code execution leading to complete server takeover, data theft, and deployment of persistent backdoors.
Likely Case
Webshell upload allowing file system access, data exfiltration, and further lateral movement within the server.
If Mitigated
Uploaded files remain isolated in non-executable directories with proper file type validation.
🎯 Exploit Status
Simple HTTP POST request manipulation with file upload. No authentication required.
🛠️ Fix & Mitigation
✅ Official Fix
Patch Version: Unknown
Vendor Advisory: https://www.campcodes.com/
Restart Required: No
Instructions:
No official patch available. Consider workarounds or migrating to alternative software.
🔧 Temporary Workarounds
Restrict access to admin directory
allBlock external access to /admin/ directory using web server configuration
# Apache: Add to .htaccess in admin directory
Order Deny,Allow
Deny from all
Allow from 127.0.0.1
# Nginx: Add to server block
location /admin/ {
deny all;
allow 127.0.0.1;
}
Implement file upload validation
allAdd server-side validation for file types, extensions, and content
# PHP example for admin/admin_running.php
$allowed_extensions = ['jpg', 'jpeg', 'png', 'gif'];
$file_extension = strtolower(pathinfo($_FILES['product_image']['name'], PATHINFO_EXTENSION));
if (!in_array($file_extension, $allowed_extensions)) {
die('Invalid file type');
}
🧯 If You Can't Patch
- Implement WAF rules to block file uploads to /admin/admin_running.php
- Monitor file system for new files in upload directories and alert on suspicious activity
🔍 How to Verify
Check if Vulnerable:
Attempt to upload a test file (e.g., test.php) to /admin/admin_running.php via POST request with product_image parameter. If upload succeeds without validation, system is vulnerable.Check Version:
Check source code or documentation for version 1.0 reference, or examine file headers/comments.Verify Fix Applied:
Attempt same upload test; should be rejected with proper error message or blocked access.📡 Detection & Monitoring
Log Indicators:
- HTTP POST requests to /admin/admin_running.php with file uploads
- Unusual file creations in upload directories
- Execution of uploaded files from web-accessible locations
Network Indicators:
- Unusual outbound connections from web server following file uploads
- HTTP requests with suspicious file extensions in upload parameters
SIEM Query:
source="web_logs" AND uri="/admin/admin_running.php" AND method="POST" AND (file_extension="php" OR file_extension="jsp" OR file_extension="asp")