Ready Ecommerce
Monthly
Unauthenticated SQL injection in ReadyEcommerce before 4.5.2 lets remote attackers inject into the MySQL HAVING clause of the public products listing API, because the rating parameter is concatenated into the query without parameterization in ProductController.php. Any anonymous internet user can perform time-based blind extraction of the entire database - including user records and administrator password hashes - and, because the database connection runs as root, may pivot to file-system access on the DB host. No public exploit identified at time of analysis, but the flaw is trivially reachable (AV:N/AC:L/PR:N) and reported by VulnCheck.
Stored XSS in ReadyEcommerce before 4.5.2 allows authenticated customers to inject arbitrary JavaScript into chat and support ticket messages, which executes in the browsers of any shop owner or administrator who views the messages. The root cause is unsanitized rendering via Vue.js's v-html directive across four frontend components, bypassing the framework's built-in template escaping protections. Successful exploitation can lead to session cookie theft and full administrative account takeover. No public exploit code and no CISA KEV listing have been identified at time of analysis.
Unauthenticated SQL injection in ReadyEcommerce before 4.5.2 lets remote attackers inject into the MySQL HAVING clause of the public products listing API, because the rating parameter is concatenated into the query without parameterization in ProductController.php. Any anonymous internet user can perform time-based blind extraction of the entire database - including user records and administrator password hashes - and, because the database connection runs as root, may pivot to file-system access on the DB host. No public exploit identified at time of analysis, but the flaw is trivially reachable (AV:N/AC:L/PR:N) and reported by VulnCheck.
Stored XSS in ReadyEcommerce before 4.5.2 allows authenticated customers to inject arbitrary JavaScript into chat and support ticket messages, which executes in the browsers of any shop owner or administrator who views the messages. The root cause is unsanitized rendering via Vue.js's v-html directive across four frontend components, bypassing the framework's built-in template escaping protections. Successful exploitation can lead to session cookie theft and full administrative account takeover. No public exploit code and no CISA KEV listing have been identified at time of analysis.