CVE-2026-63106: ReadyEcommerce SQLi Vulnerability

CVE-2026-63106 Overview

CVE-2026-63106 is an unauthenticated SQL injection vulnerability in ReadyEcommerce versions before 4.5.2. The flaw resides in ProductController.php, where the rating parameter from the product listing API is concatenated directly into a MySQL HAVING clause without parameterization. Remote attackers can perform time-based blind SQL injection through the unsanitized parameter to extract the entire database, including user credentials and administrator password hashes. Because the database connection runs as root, exploitation can extend to file system access on the database host. The vulnerability is classified under CWE-89 (Improper Neutralization of Special Elements used in an SQL Command).

Critical Impact
Unauthenticated attackers can exfiltrate the complete ReadyEcommerce database, including administrator password hashes, and may achieve file system access through the root-level database connection.

Affected Products

ReadyEcommerce versions prior to 4.5.2
ReadyEcommerce multi-vendor mobile app and website platform
Deployments exposing the vulnerable products API endpoint

Discovery Timeline

2026-08-10 - CVE-2026-63106 published to NVD
2026-08-10 - Last updated in NVD database

Technical Details for CVE-2026-63106

Vulnerability Analysis

The vulnerability resides in the product listing API of ReadyEcommerce. The rating query parameter is embedded directly into a MySQL HAVING clause built through string concatenation. No prepared statements, parameter binding, or input sanitization are applied before the value reaches the database driver. Because the endpoint requires no authentication, any remote attacker with network access to the application can reach the vulnerable code path.

Exploitation follows a time-based blind SQL injection pattern. The attacker submits payloads that make the database sleep for a measurable interval when a boolean condition is true, enabling one-bit-at-a-time extraction of arbitrary tables and columns. Successful exploitation yields user records, session data, and administrator password hashes stored in the underlying MySQL instance.

Root Cause

The root cause is unsafe string concatenation of untrusted HTTP input into a SQL statement inside ProductController.php. The HAVING clause context prevents ORM-level protections that might otherwise apply to WHERE filters, and the developer bypassed the framework's query builder for the rating filter.

Attack Vector

The attack vector is network-based and requires no privileges or user interaction. An attacker sends a crafted HTTP request to the products endpoint with a malicious rating value. Time-based payloads such as conditional SLEEP() calls confirm injection and drive data extraction. Because the MySQL account is configured as root, an attacker can escalate from data theft to file operations using functions like LOAD_FILE() and INTO OUTFILE, subject to the database's secure_file_priv configuration.

For additional technical detail, see the Vulncheck Security Advisory on SQL Injection.

Detection Methods for CVE-2026-63106

Indicators of Compromise

Requests to the products API containing SQL keywords such as SLEEP, BENCHMARK, UNION, or HAVING in the rating parameter.
Anomalously long response times on the product listing endpoint, indicating time-based blind injection probing.
MySQL query logs showing malformed HAVING clauses originating from the application user.
Access to sensitive tables such as users or admins shortly after suspicious product API traffic.

Detection Strategies

Deploy web application firewall rules that inspect the rating parameter for SQL metacharacters and time-delay functions.
Enable MySQL general query logging on the ReadyEcommerce database and alert on SLEEP(, BENCHMARK(, or INFORMATION_SCHEMA access from the application account.
Correlate HTTP request duration outliers with parameter fuzzing patterns targeting the products endpoint.

Monitoring Recommendations

Monitor authentication logs for unexpected administrator logins following suspicious API traffic.
Track outbound file writes from the MySQL data directory to detect INTO OUTFILE abuse.
Alert on high-volume, low-variance requests to the product listing API that suggest automated extraction.

How to Mitigate CVE-2026-63106

Immediate Actions Required

Upgrade ReadyEcommerce to version 4.5.2 or later, which addresses the SQL injection in ProductController.php.
Rotate all administrator and user credentials, along with any API tokens or session secrets stored in the database.
Revoke root privileges from the application's MySQL account and grant only the minimum privileges required.
Review database and web server logs for signs of prior exploitation and data exfiltration.

Patch Information

The vendor has released ReadyEcommerce 4.5.2, which parameterizes the rating filter and removes the vulnerable concatenation in ProductController.php. Product distribution and update information is available on the Codecanyon E-commerce App Overview.

Workarounds

Place the application behind a web application firewall configured to block SQL injection payloads in the rating parameter.
Restrict the MySQL account used by ReadyEcommerce so it cannot read or write files (FILE privilege removed) and cannot access databases beyond the application schema.
Set secure_file_priv to a non-writable path in my.cnf to prevent INTO OUTFILE abuse until the patch is applied.

bash

# Configuration example: restrict MySQL privileges for the ReadyEcommerce user
REVOKE ALL PRIVILEGES ON *.* FROM 'readyecom'@'%';
GRANT SELECT, INSERT, UPDATE, DELETE ON readyecommerce.* TO 'readyecom'@'%';
FLUSH PRIVILEGES;

# my.cnf hardening
[mysqld]
secure_file_priv = /var/empty
local_infile = 0