CVE-2025-13423: Campcodes Retro Basketball Store RCE Flaw

CVE-2025-13423 Overview

CVE-2025-13423 is an unrestricted file upload vulnerability in Campcodes Retro Basketball Shoes Online Store 1.0. The flaw resides in /admin/admin_product.php, where manipulation of the product_image parameter allows uploading arbitrary files. Authenticated administrators can upload files without proper validation, and the exploit has been publicly published. The vulnerability is mapped to [CWE-434] (Unrestricted Upload of File with Dangerous Type) and [CWE-284] (Improper Access Control). Attackers can launch the attack remotely over the network.

Critical Impact
An authenticated attacker can upload arbitrary files through the product image upload functionality, potentially leading to webshell deployment and limited compromise of the application backend.

Affected Products

Campcodes Retro Basketball Shoes Online Store 1.0
CPE: cpe:2.3:a:campcodes:retro_basketball_shoes_online_store:1.0:*:*:*:*:*:*:*
Component: admin/admin_product.php (product_image parameter)

Discovery Timeline

2025-11-20 - CVE-2025-13423 published to NVD
2026-06-17 - Last updated in NVD database

Technical Details for CVE-2025-13423

Vulnerability Analysis

The vulnerability exists in the administrative product management interface of Campcodes Retro Basketball Shoes Online Store 1.0. The admin_product.php script accepts file uploads through the product_image argument without enforcing restrictions on file type, extension, or content. An attacker with administrative privileges can submit a request containing an executable server-side script disguised as a product image. The application processes the upload and stores the file in a web-accessible directory, where the server may execute it on subsequent requests. The EPSS score is 0.297% with a percentile of 21.166, indicating low predicted exploitation probability despite a published exploit.

Root Cause

The root cause is insufficient validation of uploaded files in the product image handling logic. The application trusts client-supplied filenames and MIME types instead of performing server-side checks against an allowlist of safe image formats. Combined with improper access control [CWE-284], the upload routine fails to sanitize file extensions or verify file content through magic byte inspection.

Attack Vector

The attack requires network access and high privileges, meaning the attacker must already hold administrative credentials. After authenticating to the admin panel, the attacker submits a crafted multipart form request to /admin/admin_product.php with a malicious file in the product_image field. If the uploaded file carries a .php extension or equivalent server-executable type, the attacker can then request it directly from the web root to trigger code execution.

No verified proof-of-concept code is available in this dataset. Refer to the GitHub Issue Discussion and VulDB entry #332945 for additional technical context.

Detection Methods for CVE-2025-13423

Indicators of Compromise

Unexpected files with executable extensions (.php, .phtml, .phar) stored in product image upload directories.
POST requests to /admin/admin_product.php containing multipart form data with non-image MIME types in the product_image field.
Subsequent GET requests to uploaded files in image storage paths returning dynamic content rather than image data.

Detection Strategies

Monitor web server access logs for POST requests targeting /admin/admin_product.php followed by GET requests to newly created files in image directories.
Inspect file system changes in product image directories using integrity monitoring to flag non-image file types.
Audit administrative session activity for anomalous upload patterns or off-hours access to the product management interface.

Monitoring Recommendations

Enable detailed PHP and web server access logging with full request body capture for the /admin/ path.
Correlate failed admin login attempts with successful logins followed by file upload activity.
Track outbound connections from the web server process to identify post-exploitation command-and-control traffic.

How to Mitigate CVE-2025-13423

Immediate Actions Required

Restrict access to /admin/admin_product.php using network ACLs, VPN, or IP allowlisting until a vendor patch is applied.
Rotate all administrative credentials and enforce strong, unique passwords with multi-factor authentication where possible.
Audit the product image upload directory for unauthorized files and remove any non-image artifacts.

Patch Information

No official vendor patch has been published in the available references. Monitor the CampCodes Security Resource and the VulDB CTI entry for vendor updates. Until a fix is released, treat the application as vulnerable and apply compensating controls.

Workarounds

Configure the web server to disable script execution within the product image upload directory using directives such as php_flag engine off or equivalent.
Implement a server-side file type allowlist that validates MIME type, magic bytes, and extension before storing uploads.
Rename uploaded files to randomized non-executable names and serve them through a separate static content domain.
Deploy a web application firewall rule that blocks multipart uploads to admin_product.php containing PHP tags or executable extensions.

bash

# Apache configuration example to disable script execution in upload directory
<Directory "/var/www/html/uploads/product_images">
    php_flag engine off
    AddType text/plain .php .phtml .php3 .php4 .php5 .phar
    <FilesMatch "\.(php|phtml|phar)$">
        Require all denied
    </FilesMatch>
</Directory>