PT-2025-47529 · Campcodes · Campcodes Retro Basketball Shoes Online Store

Laosiji · Published 2025-11-19 · Updated 2025-11-24 · CVE-2025-13410

Positive Technologies (AI Summary)

CVSS v3.1

9.8

Critical

Base vector

AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

Name of the Vulnerable Software and Affected Versions Campcodes Retro Basketball Shoes Online Store version 1.0

Description A SQL injection issue exists in Campcodes Retro Basketball Shoes Online Store version 1.0. The issue is related to the manipulation of the tid parameter within an unknown function of the /admin/receipt.php file. This allows for remote execution of attacks. The exploit is publicly available. The vulnerability impacts the admin interface, which is frequently targeted by credential stuffing attempts. This issue falls within the scope of PCI DSS due to the potential exposure of payment card data, Personally Identifiable Information (PII), and order history. Access to payment data could necessitate forensic investigation and card reissuance.

Recommendations Update to a newer version that contains a fix for this vulnerability.

Exploit

Fix

Special Elements Injection

SQL injection

Weakness Enumeration

CWE-74

CWE-89

Related Identifiers

CVE-2025-13410

Affected Products

Campcodes Retro Basketball Shoes Online Store

References · 13

• 🔥 https://github.com/laosijivul/cve/issues/3 · Exploit
• https://osv.dev/vulnerability/CVE-2025-13410 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2025-13410 · Security Note
• https://vuldb.com/?ctiid.332937 · Note
• https://twitter.com/gothburz/status/1991661699833725089 · Twitter Post
• https://twitter.com/VulmonFeeds/status/1991348073654628680 · Twitter Post
• https://campcodes.com · Note
• https://t.me/CVEtracker/37787 · Telegram Post
• https://t.me/cveNotify/143859 · Telegram Post
• https://vuldb.com/?submit.693696 · Note
• https://t.me/cveNotify/143585 · Telegram Post
• https://twitter.com/CVEnew/status/1991409465745133818 · Twitter Post
• https://vuldb.com/?id.332937 · Note