CVE Alert: CVE-2025-12339 – Campcodes – Retro Basketball Shoes Online Store

Risk verdict

Urgent risk: publicly disclosed exploit with a PoC available, enabling remote SQL injection without authentication.

Why this matters

An unauthenticated injection on the admin backend can expose sensitive customer and order data, permit data tampering, or enable further compromise of the store’s database. In small to mid-size shops, such access can devastate trust, disrupt orders, and facilitate financial fraud or data exfiltration.

Most likely attack path

Remote, no-privilege-required exploitation targets /admin/admin_football.php via the pid parameter. The attacker can leverage a stored or inline SQL injection to read/modify data, with the impact limited to the database but potentially enabling follow-on access to the app server. No user interaction needed makes automated scanning viable; a misconfigured or publicly exposed admin endpoint raises exposure.

Who is most exposed

E-commerce sites with publicly reachable admin panels on standard LAMP/MEAN stacks are at highest risk, especially where admin paths are not MFA-protected or IP-restricted and where input handling relies on concatenated SQL.

Detection ideas

• Alerts for suspicious pid payloads and SQLi patterns to admin_football.php
• Increased HTTP 500/DB error responses or unusual DB error codes in web logs
• Sudden spikes in requests to the admin path from diverse IPs
• WAF signatures triggering on classic SQLi payloads (UNION/SELECT, tautologies)
• Indicators of data exfiltration attempts in database access logs

Mitigation and prioritisation

• Apply vendor patch or upgrade to fixed version; verify patch in staging before production
• Enforce parameterised queries and strict input validation on pid
• Harden admin access: IP allowlisting, MFA, VPN access, and disable internet exposure if feasible
• Deploy WAF rules to block SQLi patterns; enable comprehensive logging and alerting
• Change-management: perform code review, regression testing, and gradual rollout with active monitoring
• KEV/EPSS data unavailable here; if KEV true or EPSS ≥ 0.5, treat as priority 1