Description

ReadyEcommerce before 4.5.2 contains an unauthenticated SQL injection vulnerability in the product listing API where the rating parameter from the products endpoint is concatenated directly into a MySQL HAVING clause without parameterization in ProductController.php. Attackers can perform time-based blind SQL injection through the unsanitized rating parameter to extract the full database contents, including user credentials and administrator password hashes, with potential additional file system access due to the database connection running as root.

Executive Summary

Technical Details

Mitigations

References

Additional Metadata

{
  "score": "9.8",
  "pubDate": "2026-08-10T14:17:25.633Z",
  "pubdate": "2026-08-10T14:17:25.633Z",
  "executiveSummary": "ReadyEcommerce before version 4.5.2 suffers from an unauthenticated SQL injection vulnerability within its product listing API.\nThe flaw exists due to improper input validation and direct concatenation of user-supplied parameters into database queries.\nSpecifically, the rating parameter within the products endpoint is concatenated directly into a MySQL HAVING clause inside ProductController.php without proper parameterization or sanitization.\nThis vulnerability allows remote, unauthenticated attackers to execute arbitrary SQL commands against the underlying database.\nBy leveraging time-based blind SQL injection techniques through the rating parameter, malicious actors can systematically extract sensitive database contents, including user credentials and administrator password hashes.\nFurthermore, because the database connection operates with root privileges, successful exploitation introduces severe security risks, potentially granting attackers additional file system access or broader system compromise.\nThe vulnerability presents significant risk implications for confidentiality, integrity, and availability, requiring immediate remediation to secure affected systems against unauthorized data exfiltration.",
  "technicalDetails": "The vulnerability is rooted in insufficient input handling and the absence of parameterized queries within the application codebase.\nThe vulnerable component is identified as ProductController.php, which handles requests to the product listing API endpoints.\nWithin this controller, the rating parameter received via the products endpoint is directly concatenated into a MySQL HAVING clause without undergoing prior sanitization, escaping, or preparation.\nThe affected product versions include all installations of ReadyEcommerce prior to version 4.5.2.\nExploitation of this vulnerability requires no authentication or special user privileges, making it accessible to any network-adjacent or remote attacker capable of interacting with the product listing API over HTTP/HTTPS protocols.\nThe attack flow proceeds as follows: an unauthenticated attacker crafts a malicious HTTP request targeting the product listing endpoint, injecting specially formulated SQL payloads into the rating parameter.\nBecause the input is treated as executable SQL code rather than literal data, the MySQL database evaluates the injected syntax within the context of the HAVING clause.\nAttackers typically employ time-based blind SQL injection payloads—utilizing conditional delays such as benchmark or sleep functions—to infer data bit by bit based on server response latency, bypassing the absence of direct error-based or UNION-based output channels.\nThrough iterative querying, adversaries can extract comprehensive database contents, harvesting sensitive information such as user account details and administrative password hashes.\nIn addition to standard data exfiltration, post-exploitation impact is severely magnified because the database connection executes with root privileges.\nThis excessive privilege configuration creates opportunities for advanced post-exploitation activities, including potential file system access or further lateral movement within the hosting environment."
}