Horizon Alert
Summary of the vulnerability and why it matters
A critical vulnerability has been identified in ReadyEcommerce software that could allow attackers to access sensitive database information, including user credentials and administrator passwords, potentially leading to unauthorized system access and further compromise.
- Unauthenticated SQL injection in product API.
- Impacts sensitive data, including credentials.
- Confirm relevance and understand potential exposure.
Attack Path
How an attacker could exploit the issue
An unauthenticated attacker could exploit this vulnerability by sending a specially crafted request to the product listing API. This request would target the `rating` parameter within the `products` endpoint, which is improperly handled by the `ProductController.php` file. By manipulating this parameter, an attacker can inject malicious SQL code into the database query, potentially leading to the disclosure of sensitive information, including user credentials and administrator password hashes, and possibly gaining further access to the system.
- No authentication or privileges are required.
- A request to the product listing API triggers the vulnerability.
- Risk includes data theft and potential system compromise.
Live Threat
Current exploitation, exposure, and threat context
This vulnerability could allow an unauthenticated attacker to extract sensitive database contents, potentially including user credentials and administrator password hashes. When supported by the advisory, this could also lead to additional file system access if the database connection is running as root.
- Database contents and user credentials at risk.
- Injection via unsanitized product listing API parameter.
- Full database extraction and potential file access.
Operational Fix
Recommended remediation, mitigation, and detection steps
The application owner is responsible for this vulnerability. The first step is to identify all instances of the affected e-commerce application, confirm its reachability, and determine business criticality to prioritize remediation.
- Application owner must remediate.
- Verify external exposure and business criticality.
- Plan and execute remediation actions.
