EUVD-2026-55629
GHSA-r3fx-hv2g-j24q
Severity by source
CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X
Public API reachable with no auth or interaction (AV:N/AC:L/PR:N/UI:N); full DB read/write and availability impact give C:H/I:H/A:H, scope kept Unchanged as impact is on the vulnerable system.
Primary rating from Vendor (VulnCheck).
CVSS VectorVendor: VulnCheck
CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X
Lifecycle Timeline
3DescriptionCVE.org
ReadyEcommerce before 4.5.2 contains an unauthenticated SQL injection vulnerability in the product listing API where the rating parameter from the products endpoint is concatenated directly into a MySQL HAVING clause without parameterization in ProductController.php. Attackers can perform time-based blind SQL injection through the unsanitized rating parameter to extract the full database contents, including user credentials and administrator password hashes, with potential additional file system access due to the database connection running as root.
Articles & Coverage 2
AnalysisAI
Unauthenticated SQL injection in ReadyEcommerce before 4.5.2 lets remote attackers inject into the MySQL HAVING clause of the public products listing API, because the rating parameter is concatenated into the query without parameterization in ProductController.php. Any anonymous internet user can perform time-based blind extraction of the entire database - including user records and administrator password hashes - and, because the database connection runs as root, may pivot to file-system access on the DB host. …
Unlock full vulnerability intelligence
- Risk assessment & exploitation conditions
- Attack chain visualization
- Remediation with exact patch versions
- Threat intelligence from 22 sources
- Personal watchlist & email alerts
Free forever · No credit card required
Attack ChainAIDerived
Hypothetical attack flow derived from CVE metadata
Vulnerability AssessmentAI
| Exploitation | Exploitation requires only network reachability to the public product-listing API of a ReadyEcommerce instance older than 4.5.2 - specifically the products endpoint that accepts the rating parameter processed in ProductController.php's HAVING clause. … Additional conditions and limiting factors are described in the full assessment. |
| Risk Assessment | This is a genuine high-priority issue rather than an inflated CVSS score: the CVSS 4.0 base is 9.3 with AV:N/AC:L/AT:N/PR:N/UI:N and VC:H/VI:H/VA:H, meaning no authentication, no user interaction, low complexity, and full confidentiality/integrity/availability impact on the vulnerable system. … Full risk analysis with EPSS, KEV, and SSVC signal comparison available after sign-in. |
| Exploit Scenario | An unauthenticated attacker sends crafted HTTP requests to the public products API, setting the rating parameter to a boolean/time-based SQL payload (e.g., injecting a SLEEP-conditioned expression into the HAVING clause). By measuring response delays, they iteratively extract administrator password hashes and user records, then attempt to crack or reuse the admin hash to take over the storefront; the root-level DB connection may further enable file read/write on the database host. … |
| Remediation | Vendor-released patch: 4.5.2 - upgrade ReadyEcommerce to 4.5.2 or later, which is the primary and complete fix; consult the VulnCheck advisory (https://www.vulncheck.com/advisories/readyecommerce-unauthenticated-sql-injection-via-productcontroller-php) and the CodeCanyon product page for the update. … Detailed patch versions, workarounds, and compensating controls in full report. |
Recommended ActionAI
Within 24 hours: Identify all ReadyEcommerce instances running versions prior to 4.5.2 and immediately deploy Web Application Firewall rules to block SQL metacharacters in the 'rating' parameter of the products listing endpoint, or restrict API access to authenticated users only. …
Sign in for detailed remediation steps and compensating controls.
Threat intelligence, references, and detailed analysis are available after sign-in.
sapi/cgi/cgi_main.c in PHP before 5.3.12 and 5.4.x before 5.4.2, when configured as a CGI script (aka php-cgi), does not
(1) boardData102.php, (2) boardData103.php, (3) boardDataJP.php, (4) boardDataNA.php, and (5) boardDataWW.php in Netgear
The '/common/download_agent_installer.php' script in the Quest KACE System Management Appliance 8.0.318 is accessible by
ProjectSend versions prior to r1720 are affected by an improper authentication vulnerability. Rated critical severity (C
Roundcube Webmail contains a critical PHP object deserialization vulnerability (CVE-2025-49113, CVSS 9.9) that allows au
Util/PHP/eval-stdin.php in PHPUnit before 4.8.28 and 5.x before 5.6.3 allows remote attackers to execute arbitrary PHP c
Palo Alto Networks PAN-OS management web interface contains an authentication bypass allowing unauthenticated attackers
Nagios XI version xi-5.7.5 is affected by OS command injection. Rated high severity (CVSS 8.8), this vulnerability is re
Nagios XI version xi-5.7.5 is affected by OS command injection. Rated high severity (CVSS 8.8), this vulnerability is re
The get_referers function in /opt/ws/bin/sblistpack in Sophos Web Appliance before 3.7.9.1 and 3.8 before 3.8.1.1 allows
The Backup Migration plugin for WordPress is vulnerable to Remote Code Execution in all versions up to, and including, 1
NetAlertX (formerly PiAlert) versions 23.01.14 through 24.x before 24.10.12 allow unauthenticated command injection thro
Same weakness CWE-89 – SQL Injection
View allShare
External POC / Exploit Code
Leaving vuln.today