Campcodes Retro Basketball Shoes Online Store admin_running.php cross site scripting
翻译中…平台
php
修复版本
1.0.1
CVE-2025-13412 describes a cross-site scripting (XSS) vulnerability affecting Campcodes Retro Basketball Shoes Online Store versions 1.0. This vulnerability allows an attacker to inject malicious scripts into the application, potentially leading to session hijacking or defacement. The vulnerability resides in the /admin/adminrunning.php file and is triggered by manipulating the productname argument. A patch is expected to resolve this issue.
影响与攻击场景翻译中…
Successful exploitation of CVE-2025-13412 allows an attacker to execute arbitrary JavaScript code within the context of a user's browser session. This can lead to the theft of sensitive information, such as session cookies, which can then be used to impersonate the user. An attacker could also inject malicious code to redirect users to phishing sites or deface the website. The remote nature of the vulnerability means that an attacker does not need to be on the same network as the target system to exploit it.
利用背景翻译中…
This vulnerability has been publicly disclosed. A proof-of-concept exploit may be available, increasing the risk of exploitation. The CVSS score is LOW (2.4), suggesting that the vulnerability is relatively easy to exploit and has a limited impact. No KEV listing or active exploitation campaigns have been reported as of the publication date.
哪些人处于风险中翻译中…
Administrators of Campcodes Retro Basketball Shoes Online Store installations, particularly those running version 1.0, are at risk. Shared hosting environments where multiple websites share the same server resources are also at increased risk, as a compromise of one website could potentially lead to the compromise of others.
检测步骤翻译中…
• php / web:
grep -r 'product_name' /var/www/campcodes/• generic web:
curl -I <target_url>/admin/admin_running.php?product_name=<script>alert(1)</script>• generic web:
grep -r 'admin_running.php' /var/log/apache2/access.log攻击时间线
- Disclosure
disclosure
威胁情报
漏洞利用状态
EPSS
0.06% (18% 百分位)
CISA SSVC
CVSS 向量
这些指标意味着什么？
- Attack Vector
- 网络 — 可通过互联网远程利用，无需物理或本地访问。攻击面最大。
- Attack Complexity
- 低 — 无需特殊条件，可以稳定地利用漏洞。
- Privileges Required
- 高 — 需要管理员或特权账户。
- User Interaction
- 需要 — 受害者必须打开文件、点击链接或访问特制页面。
- Scope
- 未改变 — 影响仅限于脆弱组件本身。
- Confidentiality
- 无 — 无机密性影响。
- Integrity
- 低 — 攻击者可修改部分数据，影响有限。
- Availability
- 无 — 无可用性影响。
受影响的软件
弱点分类 (CWE)
时间线
- 已保留
- 发布日期
- 修改日期
- EPSS 更新日期
缓解措施和替代方案翻译中…
The primary mitigation for CVE-2025-13412 is to upgrade to a patched version of Campcodes Retro Basketball Shoes Online Store. As no fixed version is specified, contact the vendor for an update. Until a patch is available, consider implementing input validation and output encoding on the productname parameter in /admin/adminrunning.php to sanitize user-supplied data. Web application firewalls (WAFs) configured to detect and block XSS attacks can also provide a layer of protection.
修复方法翻译中…
Actualizar a una versión parcheada o aplicar las medidas de seguridad necesarias para evitar la inyección de código malicioso a través del parámetro product_name en el archivo admin_running.php. Validar y limpiar las entradas del usuario es crucial para prevenir ataques XSS.
CVE 安全通讯
漏洞分析和关键警报直接发送到您的邮箱。
常见问题翻译中…
What is CVE-2025-13412 — XSS in Campcodes Retro Basketball Shoes?
CVE-2025-13412 is a cross-site scripting (XSS) vulnerability in Campcodes Retro Basketball Shoes Online Store version 1.0, allowing attackers to inject malicious scripts via the product_name parameter.
Am I affected by CVE-2025-13412 in Campcodes Retro Basketball Shoes?
If you are running Campcodes Retro Basketball Shoes Online Store version 1.0, you are potentially affected by this vulnerability. Check with the vendor for a patch.
How do I fix CVE-2025-13412 in Campcodes Retro Basketball Shoes?
The recommended fix is to upgrade to a patched version of Campcodes Retro Basketball Shoes Online Store. Contact the vendor for an update.
Is CVE-2025-13412 being actively exploited?
While no active exploitation campaigns have been confirmed, the vulnerability has been publicly disclosed, increasing the risk of exploitation.
Where can I find the official Campcodes advisory for CVE-2025-13412?
Please refer to the Campcodes website or contact their support team for the official advisory regarding CVE-2025-13412.