ReadyEcommerce <= 4.5.1 SQL Injection Vulnerability: Early Warning
- Severity
- CRITICAL
- CVSS
- 9.8
- Affected component
- readyecommerce (npm)
- Patched version
- 4.5.2
An early warning has been issued for a critical SQL injection vulnerability in ReadyEcommerce versions before 4.5.2. This vulnerability allows unauthenticated attackers to extract full database contents.
What happened
ReadyEcommerce versions before 4.5.2 reportedly contain an unauthenticated SQL injection vulnerability in the product listing API. The vulnerability arises from the direct concatenation of the rating parameter into a MySQL HAVING clause without parameterization in ProductController.php. Attackers can exploit this through time-based blind SQL injection to extract the full database contents, including user credentials and administrator password hashes. The database connection runs as root, which may allow additional file system access.
The vulnerability was first flagged on 2026-08-10T14:17:25.633000+00:00. It has a CVSS score of 9.8, indicating a critical severity level. There is no evidence that this vulnerability has been exploited in the wild. The issue is tracked under CVE-2026-63106.
What to do about it
- Upgrade to ReadyEcommerce 4.5.2 or later to mitigate the vulnerability.
- Review and strengthen database access controls to limit potential damage from SQL injection attacks.
- Monitor the NVD page for CVE-2026-63106 for any updates or additional information.
How 0Day would have caught this
readyecommerce is anywhere in your dependency tree, the engineers who own the affected repositories get a push alert the moment it is flagged — no manual audit to remember to run.Read how this differs from waiting on a scanner to catch a known advisory, or see the exact, read-only access 0Day needs to do this for an organization.
Frequently asked questions
Am I affected?
You are affected if you are using ReadyEcommerce version 4.5.1 or earlier.
What should I do right now?
Upgrade to ReadyEcommerce 4.5.2 or later and review your database access controls.
Is this vulnerability being exploited in the wild?
There is no evidence that this vulnerability has been exploited in the wild at this time.