CVE-2026-63106 describes an unauthenticated SQL injection vulnerability in Razinsoft Ready eCommerce versions prior to 4.5.2. The flaw exists in the product listing API where the rating parameter is unsafely concatenated into a MySQL HAVING clause within ProductController.php without parameterization or sanitization. This allows attackers to conduct time-based blind SQL injection attacks to extract the entire database, including sensitive credentials. The database connection operates with root privileges, increasing the risk of additional system compromise.

Exploitation of this vulnerability can lead to full disclosure of the database contents, including user credentials and administrator password hashes. Because the database connection runs as root, attackers may also gain unauthorized file system access, potentially leading to complete system compromise. The vulnerability requires no authentication and has a critical severity score of 9.3, indicating a high risk of severe impact.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until an official fix is available, restrict access to the vulnerable API endpoint and monitor for suspicious activity. Avoid using the affected versions in production environments if possible.