CVE-2026-7848: SQL Injection in Alior Bank raty PrestaShop module
Alior Bank PrestaShop module "raty" for commercial partners is vulnerable to SQL Injection in the "hookActionObjectProductUpdateBefore", "hookActionObjectCategoryUpdateBefore", and "hookActionObjectCategoryAddAfter" hook methods. The module inserts values of the POST parameters "aliorproductpromotion", "aliorcategorypromotion" and "aliorcategoryenabled" directly into SQL UPDATE queries without any sanitization or validation. An attacker with access to the product or category add/edit functionality in the PrestaShop backoffice can inject arbitrary SQL, potentially allowing unauthorized access to and modification of database contents. This issue was fixed in versions: 9.0.7 and 8.1.11
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
Alior Bank PrestaShop module "raty"to a version that resolves this vulnerability.Fixed in 9.0.7 - Upgrade
Upgrade
Alior Bank PrestaShop module "raty"to a version that resolves this vulnerability.Fixed in 8.1.11
Event History
Frequently Asked Questions
Who can exploit this issue?
An attacker needs access to product or category add/edit functionality in the PrestaShop backoffice. The vulnerable inputs are POST parameters processed during product updates, category updates, and category creation.
Which inputs and operations are affected?
The affected parameters are alior_product_promotion, alior_category_promotion, and alior_category_enabled. They are used by the product-update, category-update, and category-add hook methods.
What is the potential impact of successful exploitation?
An attacker may inject arbitrary SQL through the affected parameters. This can potentially provide unauthorized access to database contents and allow their modification.
Which versions contain the fix?
The issue was fixed in versions 9.0.7 and 8.1.11.