An unauthenticated SQL injection vulnerability in Campcodes Retro Basketball Shoes Online Store version 1.0 poses a significant risk of unauthorized database interaction.

This vulnerability is a SQL injection (CWE-89) flaw located within the /admin/admin_product.php file. An unauthenticated remote attacker can exploit this by manipulating the pid parameter to execute arbitrary SQL commands.

The exploitation of this vulnerability can lead to unauthorized access to the underlying database, potentially resulting in data exfiltration or integrity compromise. Given the CVSS score of 7.3, this is classified as a High severity issue. Failure to mitigate this flaw may allow attackers to gain visibility into sensitive backend information, threatening the confidentiality and operational security of the online store.

Immediate Action: As no official patch is currently available, administrators should restrict access to the /admin/ directory using IP allowlisting or VPN requirements until a vendor-supplied update is released.

Proactive Monitoring: Monitor server access logs for anomalous HTTP requests targeting the /admin/admin_product.php file, specifically looking for SQL syntax patterns within the pid parameter.

Compensating Controls: Deploy a Web Application Firewall (WAF) with custom rules designed to detect and block SQL injection payloads targeting the identified endpoint.

Public Exploit Available: Yes, a published proof-of-concept exists as documented in the research write-up at https://github.com/HYLCXH/CVE/issues/16.

Due to the availability of a public proof-of-concept and the unauthenticated nature of the attack vector, this vulnerability presents a credible risk to the affected infrastructure. Organizations should prioritize isolating the vulnerable application component and monitoring for suspicious activity until an official security patch is provided by the vendor.