A critical SQL injection vulnerability in Campcodes Retro Basketball Shoes Online Store 1.0 allows unauthenticated remote attackers to manipulate database queries.

The application is susceptible to SQL injection through the Username argument in the admin_index.php script. This flaw allows an unauthenticated remote attacker to inject malicious SQL commands into the backend database.

The vulnerability carries a CVSS score of 7.3, representing a high risk to the confidentiality, integrity, and availability of the application. Successful exploitation could lead to unauthorized data exposure, bypass of authentication mechanisms, or potential database corruption, which may result in significant operational disruption and loss of sensitive customer information.

Immediate Action: Since no official patch is currently available, administrators should restrict network access to the /admin/ directory and consider disabling the vulnerable component until a fix is released by the vendor.

Proactive Monitoring: Security teams should review web server access logs for suspicious input patterns containing SQL keywords or characters like single quotes, dashes, or semicolon delimiters targeting the admin_index.php endpoint.

Compensating Controls: Deploy a Web Application Firewall (WAF) with updated rulesets designed to detect and block common SQL injection payloads before they reach the application server.

Public Exploit Available: Yes, a published proof of concept exists via the referenced GitHub issue.

Given the public availability of exploit material and the unauthenticated nature of this vulnerability, immediate defensive measures are required. Organizations should prioritize restricting access to the administrative interface and implementing WAF protections to mitigate the risk of exploitation while awaiting a vendor-supplied security update.