CVE-2025-13410CWE-74CWE-89sql-injection

CVE-2025-13410

High · published November 20, 2025

CVSS v3.1
7.3
EPSS
0%
Percentile
35.3
In the wild
Unconfirmed
What it is

⚠️ A sneaky SQL injection is lurking in the Campcodes Retro Basketball Shoes store! Just by manipulating one argument, an attacker could exploit this vulnerability remotely. 🏀 Think of it like a customer who manages to slip a fake order into the system without anyone checking the register—this opens the door for all sorts of mischief. If the store doesn't fix this, it could lead to an avalanche of fraudulent orders! An attacker could potentially manipulate the database, leading to unauthorized access or alterations of critical data—imagine losing track of your inventory or worse, exposing sensitive customer information. While it’s not actively exploited, the public disclosure means it’s just waiting for a curious hacker to take advantage of it.

Put simply

Think of it like a customer who manages to slip a fake order into the system without anyone checking the register—this opens the door for all sorts of mischief. If the store doesn't fix this, it could lead to an avalanche of fraudulent orders! The vulnerability is caused by insufficient input validation in the `tid` parameter of the `/admin/receipt.php` file, allowing for SQL injection attacks. This means an attacker could execute arbitrary SQL commands against the database remotely, compromising its integrity.

What to do

An attacker could potentially manipulate the database, leading to unauthorized access or alterations of critical data—imagine losing track of your inventory or worse, exposing sensitive customer information. While it’s not actively exploited, the public disclosure means it’s just waiting for a curious hacker to take advantage of it. Immediately patch your Campcodes Retro Basketball Shoes store to the latest version. Ensure that input validation is properly implemented for all parameters, especially those interacting with the database. Regularly audit your application for vulnerabilities to prevent future exploits. You've got this! With these steps, you'll strengthen your security and keep the basketballs bouncing safely! 🛡️

The record
Technical detail
CVSS v3.1
7.3 · HIGH
Vector
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:L
CVSS v4.0
Not supplied
EPSS
0.00421 · 35.3th percentile
Weaknesses
CWE-74 · Improper Neutralization of Special Elements in Output Used by a Downstream Component ('Injection'); CWE-89 · Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection')
Published
2025-11-20T02:15Z
Affected products (1)
ProductVersionsFixed in
campcodes/retro_basketball_shoes_online_storeall versions—
References (6)
EPSS history
Timeline
  • 19 NOV 20:32Z
    Campcodes Retro Basketball Shoes Online Store receipt.php sql injection
    cvelistv5