External risk intelligence

Campcodes Retro Basketball Shoes Online Store SQL Injection Vulnerability.

CVE advisorySeverity: CRITICAL (CVSS 9.8)

CVE-2023-2206

The vulnerability exists in an online store web application, specifically within a contact form component. Online stores are designed to be public-facing web applications accessible via the internet for customer interaction, making this surface commonly exposed by default.

SQL Injection

Campcodes Retro Basketball Shoes Online Store

1.0

Halo Surface Signal: 4 out of 5 — likely to be public-facing.

External exposure likelihood

Horizon Alert

Summary of the vulnerability and why it matters

A critical vulnerability has been publicly disclosed in the Campcodes Retro Basketball Shoes Online Store, specifically within the contactus.php file. This issue could allow remote attackers to inject malicious SQL code, potentially leading to unauthorized access or modification of data. The main concern is confirming if this specific application is in use and if it is exposed to the internet.

Flaw allows remote attackers to inject malicious code.
Matters if our online store application is exposed.
Confirm relevance and exposure for any potential risk.

Attack Path

How an attacker could exploit the issue

An attacker could exploit this vulnerability by sending a specially crafted request to the online store's website, targeting the contact form. If the `email` argument is manipulated, it could lead to a SQL injection, allowing the attacker to potentially access, modify, or delete sensitive data on the server.

No authentication required for attack.
Vulnerable component is `contactus.php`.
Risk of data compromise and integrity loss.

Live Threat

Current exploitation, exposure, and threat context

A critical vulnerability in an online store's contact form could allow remote attackers to inject malicious SQL commands. This could lead to unauthorized access or modification of the store's database, potentially affecting system integrity and stored information.

Database integrity and system data.
Remote manipulation of the 'email' argument.
Unauthorized database access or modification.

Operational Fix

Recommended remediation, mitigation, and detection steps

The owners of the Campcodes Retro Basketball Shoes Online Store application, likely application or platform teams, must first identify all instances of this software, determine their reachability and criticality, and locate the accountable individuals. Following this, a risk-based remediation plan can be developed, potentially involving coordination with the vendor for a permanent fix or the implementation of temporary mitigations.

Application and platform teams should own this.
Verify all instances and their exposure.
Plan remediation based on identified risk.

Supplementary metadata

CVSS vector

Validate whether this threat affects your internet-facing exposure.

Halo Threat Intelligence helps prioritize remediation with Halo Surface Signal and H/A/L/O context. Start exposure validation with a free external attack surface trial.

Free EASM Trial See How Signal Works

Frequently asked questions

What is the Campcodes Retro Basketball Shoes Online Store software?

This software is a web-based e-commerce platform designed for selling footwear. It typically provides store owners with storefront functionality, including public-facing contact forms that allow visitors to reach out to the business directly through the application.

What does SQL injection mean for CVE-2023-2206?

This vulnerability belongs to the CWE-89 weakness class. It means the application fails to properly sanitize user input, allowing an attacker to inject and execute their own database commands. In this case, manipulating the email field can trick the database into performing unauthorized actions, such as revealing, changing, or deleting sensitive information stored by the store.

How can an attacker trigger this vulnerability?

The attack is triggered by sending a specially crafted request to the contactus.php file. By injecting malicious SQL code into the email argument of that form, an attacker can influence the database. It is important to note that the vulnerability does not require the attacker to have an existing account or any special permissions; it is accessible to anyone who can interact with that specific web page.

Is my deployment at risk from this vulnerability?

According to Halo Surface Signal, this software is inherently designed to be public-facing to facilitate customer communication, which often makes it reachable from the internet. If you have instances of this online store deployed in a way that allows external access to the contact form, your environment matches the profile for this vulnerability and warrants immediate investigation.

What should I do if I am running this software?

Begin by identifying all running instances of the application within your infrastructure and confirm their network reachability. Once you have a complete inventory, coordinate with your technical teams to assess the risk. Develop a plan to either apply an official vendor update if available or implement temporary controls to block malicious requests to the affected contact component while you evaluate a permanent solution.

References

Written by Nicholas Merritt

Nicholas Merritt is VP of Security Solutions at Halo Security. With more than 25 years across application security, vulnerability prioritization, and offensive security, he helps teams translate threat data into practical exposure validation and remediation focus. He authors Halo Threat Intelligence CVE advisories using Halo Surface Signal and H/A/L/O context to prioritize internet-facing risk.