A critical SQL injection vulnerability in Campcodes Retro Basketball Shoes Online Store 1.0 allows unauthenticated remote attackers to manipulate database queries.

The application is susceptible to SQL injection (CWE-89) within the tid argument of the admin/receipt.php script. This flaw allows an unauthenticated remote attacker to inject malicious SQL commands, potentially exposing sensitive database information.

Successful exploitation of this vulnerability can lead to unauthorized access to the underlying database, potentially resulting in the compromise of customer data or administrative credentials. With a CVSS score of 7.3, this high-severity flaw represents a significant risk to the confidentiality and integrity of the application. Failure to address this issue may lead to data breaches and potential regulatory non-compliance.

Immediate Action: Since no official patch is currently available, administrators should restrict access to the affected /admin/receipt.php file or disable the vulnerable component entirely until a fix is provided by the vendor.

Proactive Monitoring: Monitor server access logs for anomalous HTTP requests targeting the admin/receipt.php endpoint, specifically looking for unusual patterns in the tid parameter.

Compensating Controls: Deploy a Web Application Firewall (WAF) with rules configured to detect and block SQL injection patterns to provide a virtual patch against exploitation attempts.

Public Exploit Available: Yes, a public proof-of-concept exists as documented in the referenced GitHub issue.

Given the availability of a public proof-of-concept and the ease of exploitation, this vulnerability poses an immediate risk to any deployment of Campcodes Retro Basketball Shoes Online Store 1.0. Organizations should prioritize isolating the affected application from the internet and monitor for signs of unauthorized database interaction until the vendor releases a security update.