Description

CERT Polska has received a report about vulnerabilities in Alior Bank "raty" module for PrestaShop and participated in coordination of their disclosure.

The vulnerability CVE-2026-7848: Alior Bank PrestaShop module "raty" for commercial partners is vulnerable to SQL Injection in the hookActionObjectProductUpdateBefore, hookActionObjectCategoryUpdateBefore, and hookActionObjectCategoryAddAfter hook methods. The module inserts values of the POST parameters alior_product_promotion, alior_category_promotion and alior_category_enabled directly into SQL UPDATE queries without any sanitization or validation. An attacker with access to the product or category add/edit functionality in the PrestaShop backoffice can inject arbitrary SQL, potentially allowing unauthorized access to and modification of database contents.

This issue was fixed in versions: 9.0.7 and 8.1.11

The vulnerability CVE-2026-15600: Alior Bank PrestaShop module "raty" for commercial partners is vulnerable to SQL Injection in the toggleCategoryPromotionAction method. The module inserts value of the POST parameter status into SQL UPDATE queries without any sanitization or validation. An attacker with access to the product or category add/edit functionality in the PrestaShop backoffice can inject arbitrary SQL, potentially allowing unauthorized access to and modification of database contents.

This issue was fixed in versions: 9.0.8 and 8.1.12

Credits

We thank Krzysztof Winiarski for the responsible vulnerability report.