An unauthenticated SQL injection vulnerability in Campcodes Retro Basketball Shoes Online Store 1.0 poses a significant risk of unauthorized database interaction and data exposure.

This vulnerability is a SQL injection flaw located in the /admin/admin_football.php file. An unauthenticated attacker can exploit this by injecting malicious SQL commands into the pid argument.

The ability for an unauthenticated remote attacker to perform SQL injection can lead to unauthorized access to sensitive data, potential modification of database content, and overall compromise of the application integrity. With a CVSS score of 7.3, this high-severity vulnerability warrants immediate attention as it allows for trivial exploitation of the backend database.

Immediate Action: Since no official patch is currently available, administrators should restrict network access to the /admin/ directory and disable the vulnerable functionality if possible.

Proactive Monitoring: Monitor server access logs for anomalous HTTP requests targeting /admin/admin_football.php, specifically searching for SQL syntax characters such as single quotes, semicolons, or comment indicators in the pid parameter.

Compensating Controls: Deploy a Web Application Firewall (WAF) with rules configured to inspect and block common SQL injection patterns directed at the identified endpoint.

Public Exploit Available: Yes, a public proof-of-concept exists as documented in the referenced GitHub issue.

Given the availability of public proof-of-concept code and the ease of remote exploitation, this vulnerability presents a tangible risk to any deployment of the affected software. Organizations currently running Campcodes Retro Basketball Shoes Online Store 1.0 should prioritize isolating the application until a vendor-supplied security update is released and verified.