Unauthenticated SQL Injection in ReadyEcommerce Product API

ReadyEcommerce versions prior to 4.5.2 contain a critical unauthenticated SQL injection vulnerability in the product listing API. The vulnerability originates in ProductController.php, where the rating parameter is concatenated directly into a MySQL HAVING clause without proper parameterization. This flaw allows unauthenticated remote attackers to execute arbitrary SQL queries against the underlying database via time-based blind SQL injection techniques. Given the reported configuration where the database service runs with root privileges, successful exploitation may lead to full database compromise, extraction of sensitive user credentials and administrator password hashes, and potential file system access. This vulnerability poses a severe risk to the confidentiality and integrity of the affected e-commerce environments.

Impact

Successful exploitation allows for the full extraction of database contents, including user credentials and administrative password hashes. Due to the database running with root privileges, there is a risk of escalation to unauthorized file system access on the host server.

Recommendation

• Update ReadyEcommerce to version 4.5.2 or later to remediate the vulnerability in ProductController.php.
• Implement input validation and parameterized queries to prevent SQL injection in the product listing API.
• Audit database service configurations to ensure that the database process runs with the least privilege necessary rather than root.
• Monitor webserver access logs for anomalous POST or GET requests to the product listing endpoint containing SQL syntax or time-delay functions (e.g., SLEEP(), BENCHMARK()).