CVE-2026-63106

Name of the Vulnerable Software and Affected Versions ReadyEcommerce versions prior to 4.5.2

Description An unauthenticated SQL injection exists in the product listing API. The issue occurs because the rating parameter in the 'products' endpoint is concatenated directly into a MySQL HAVING clause without parameterization within ProductController.php. This allows attackers to perform time-based blind SQL injection—a technique used to infer data by observing the time the server takes to respond to specific queries—to extract the entire database, including user credentials and administrator password hashes. Additionally, because the database connection runs as root, there is a potential for unauthorized file system access.

Recommendations Update ReadyEcommerce to version 4.5.2 or later. As a temporary mitigation, restrict access to the 'products' endpoint or avoid using the rating parameter until the update is applied.