CVE-2026-63106 describes an unauthenticated SQL injection vulnerability in Razinsoft Ready eCommerce prior to version 4.5.2. The flaw exists in the product listing API's handling of the rating parameter, which is concatenated directly into a MySQL HAVING clause in ProductController.php without parameterization or sanitization. This allows attackers to conduct time-based blind SQL injection attacks to extract the entire database contents, including sensitive user credentials and administrator password hashes. Because the database connection operates with root privileges, attackers may also gain additional file system access. The vulnerability is rated critical with a CVSS 4.0 score of 9.3. No patch or official remediation level is currently documented.

Successful exploitation can lead to full database disclosure, including user credentials and administrator password hashes. The root-level database connection increases the risk of further system compromise through file system access. The vulnerability requires no authentication and can be exploited remotely, making it highly severe.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until an official fix is available, restrict access to the vulnerable API endpoint if possible and monitor for suspicious activity related to the rating parameter. Avoid exposing the product listing API publicly if feasible.