CVE-2025-13411 is a medium severity unrestricted file upload in Campcodes Retro Basketball Shoes Online Store 1.0, scored 4.7 by CVSS 3.1. The upload handling in /admin/admin_football.php accepts files it should reject. The record lists no fix, so add file checks and review what has already been uploaded.
What's affected
The record names Campcodes Retro Basketball Shoes Online Store, 1.0. The affected code is /admin/admin_football.php, and the input at fault is the product_image field. The attack is remote and low complexity with no user interaction. The vector shows a high privilege, administrator level account is required, which explains the lower score.
The record says an exploit has been disclosed publicly. It does not say the flaw is exploited in the wild, and it is not on the CISA Known Exploited Vulnerabilities list.
No fixed version is named in the record or its references.
How to check if you're exposed
Find out where the app is deployed and which folder receives uploads. Then list what is in that folder. Anything that is not an image or document you expect, in particular files with script extensions such as .php, is a red flag.
find /path/to/uploads -type f ! -iname "*.jpg" ! -iname "*.png" ! -iname "*.gif"
Review the web server configuration as well. If the upload folder is served by a web server that also runs PHP, an uploaded script may be executable. Check access logs for requests to the upload path from unknown clients. A static analysis scan of the upload handler will show whether file type and content are checked at all.
What to do now
- Find every copy of this application, including test copies.
- Restrict access to the upload feature until it is fixed. If it is not needed, disable it.
- Review the upload folder and remove unknown files after keeping copies for investigation.
- Configure the web server so that the upload folder never executes scripts.
- In the code, accept only an allowlist of file types, check content rather than just the file name, and store files with generated names outside the web root where you can.
- Check the maintainer's site for a newer release before relying on any claim of a fix.
- If you find a script in the upload folder, treat the host as compromised and rotate credentials stored on it.
Why it matters
The weaknesses named are CWE-434 (unrestricted upload of a file with a dangerous type) and CWE-284 (improper access control). The application lets a user choose what goes onto the server and does not enough to confirm it is harmless. The danger is greatest when the stored file can then be fetched and run by the web server, which turns a file upload into code execution.
The scores are modest because the vector rates each of confidentiality, integrity and availability impact as low, and the record does not claim the upload becomes code execution. Real impact depends on server configuration, which is why checking the upload folder matters more than the number.
Upload handlers are a common weak spot in small PHP projects. The Gold directory tracks this entry.
Quick check
Is there a patch for CVE-2025-13411?
The record does not name one. Check the maintainer's site and the advisory, and add upload validation yourself if you must keep the app running.
How do I tell if I was hit?
Look in the upload folder for files that are not the images or documents you expect, especially script files, and review access logs for requests to them.
Sources
Last reviewed: 19 October 2026.
