A critical SQL injection vulnerability in Campcodes Retro Basketball Shoes Online Store 1.0 allows unauthenticated remote attackers to manipulate database queries.

This vulnerability is a SQL injection flaw (CWE-89) located in the admin_running.php file. An unauthenticated attacker can execute arbitrary SQL commands by manipulating the pid argument, potentially leading to unauthorized data exposure or modification.

Successful exploitation of this vulnerability allows an unauthenticated remote attacker to interact directly with the application database. Given the CVSS score of 7.3, this represents a significant risk to data confidentiality and integrity. If exploited, the breach could result in the unauthorized extraction of sensitive store information, customer data, or administrative credentials, leading to potential operational disruption and reputational harm.

Immediate Action: As no official patch is currently available, administrators should restrict access to the /admin/ directory using IP allowlisting or VPN requirements. Developers must sanitize all inputs within the pid argument of admin_running.php to prevent SQL injection.

Proactive Monitoring: Monitor server access logs for anomalous HTTP requests targeting the admin_running.php endpoint, particularly those containing SQL syntax characters like single quotes, dashes, or union statements.

Compensating Controls: Deploy a Web Application Firewall (WAF) with specific rules configured to detect and block common SQL injection patterns targeting the identified vulnerable script.

Public Exploit Available: Yes, a published proof-of-concept exists via a security researcher's GitHub issue report.

The presence of a public proof-of-concept for an unauthenticated SQL injection vulnerability makes this a high-priority issue for any organization hosting this software. Given the lack of a vendor-provided patch, immediate isolation of the affected administrative interface is required to prevent unauthorized access. Organizations should prioritize migrating away from this software or implementing strict network-level access controls until the vendor releases a secure update.