Vulnerability · Published Nov 19, 2025 · Assigned by VulDB

CVE-2025-13423Campcodes Retro Basketball Shoes Online Store admin_product.php unrestricted upload

Medium 4.7

In plain English

A medium-severity unrestricted file upload in Retro Basketball Shoes Online Store from Campcodes. Proof-of-concept exploit code is public. The chance it is exploited in the next 30 days is estimated at 0.4% (higher than 31% of all known vulnerabilities).

Severity (CVSS 3.1)4.7Medium

Exploit odds (30 days)0.4%top 69.1% of all CVEs

Exploited in the wildNo reportsCISA SSVC: poc

Attack toolingNoneno public tooling known

Official description

A flaw has been found in Campcodes Retro Basketball Shoes Online Store 1.0. The impacted element is an unknown function of the file /admin/admin_product.php. Executing a manipulation of the argument product_image can lead to unrestricted upload. The attack may be launched remotely. The exploit has been published and may be used.

Affected products (as reported)

Vendor	Product	Versions
Campcodes	Retro Basketball Shoes Online Store	1.0

Weakness: CWE-434, CWE-284 · Vector: CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:L/I:L/A:L/E:P/RL:X/RC:R

References

VDB-332945 | Campcodes Retro Basketball Shoes Online Store admin_product.php unrestricted upload vdb-entry, technical-description
VDB-332945 | CTI Indicators (IOB, IOC, TTP, IOA) signature, permissions-required
Submit #696051 | Campcodes Retro Basketball Shoes Online Store v1.0 Unrestricted Upload third-party-advisory
https://github.com/Abxery/cveee/issues/6 exploit, issue-tracking
https://www.campcodes.com/ product