An unauthenticated SQL injection vulnerability in Campcodes Retro Basketball Shoes Online Store 1.0 poses a significant risk of unauthorized database interaction.

This is a SQL injection flaw (CWE-89) located within the /admin/admin_feature.php script. An unauthenticated remote attacker can manipulate the pid parameter to inject malicious SQL commands into the application database.

The vulnerability carries a CVSS score of 7.3, reflecting its high potential for impact despite the limited scope of the base vector. Successful exploitation could lead to unauthorized data exposure, modification of database contents, or potential service disruption within the online store environment.

Immediate Action: Since no official patch is currently available, administrators should restrict access to the /admin/ directory using network-level controls or IP allowlisting to prevent unauthenticated access.

Proactive Monitoring: Review web server and database logs for anomalous SQL syntax or unexpected query patterns originating from the /admin/admin_feature.php endpoint.

Compensating Controls: Deploy a Web Application Firewall (WAF) with rules configured to detect and block SQL injection patterns specifically targeting the pid parameter in the application URL structure.

Public Exploit Available: Yes — a published proof-of-concept exists in the researcher's write-up at the referenced GitHub repository.

Given the availability of a public proof-of-concept, this vulnerability should be treated with high priority. Organizations using this software must implement immediate network-level restrictions to prevent unauthorized access to the vulnerable administrative endpoint until an official vendor patch is released.