Vulnerabilities in Alior Bank "raty" module for PrestaShop

CVE ID: CVE-2026-7848

Publication date: 14 September 2026

Vendor: Alior Bank

Product: raty

Vulnerable versions: From 8.0.0 to 8.1.11

Vulnerability type (CWE): Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') (CWE-89)

Report source: Report to CERT Polska

CVE ID: CVE-2026-15600

Publication date: 14 September 2026

Vendor: Alior Bank

Product: raty

Vulnerable versions: From 8.1.9 to 8.1.12

Vulnerability type (CWE): Improper neutralization of special elements used in an SQL command ('SQL injection') (CWE-89)

Report source: Report to CERT Polska

Description

CERT Polska has received a report about vulnerabilities in Alior Bank "raty" module for PrestaShop and participated in coordination of their disclosure.

The vulnerability CVE-2026-7848: Alior Bank PrestaShop module "raty" for commercial partners is vulnerable to SQL Injection in the hookActionObjectProductUpdateBefore, hookActionObjectCategoryUpdateBefore, and hookActionObjectCategoryAddAfter hook methods. The module inserts values of the POST parameters alior_product_promotion, alior_category_promotion and alior_category_enabled directly into SQL UPDATE queries without any sanitization or validation. An attacker with access to the product or category add/edit functionality in the PrestaShop backoffice can inject arbitrary SQL, potentially allowing unauthorized access to and modification of database contents.

This issue was fixed in versions: 9.0.7 and 8.1.11

The vulnerability CVE-2026-15600: Alior Bank PrestaShop module "raty" for commercial partners is vulnerable to SQL Injection in the toggleCategoryPromotionAction method. The module inserts value of the POST parameter status into SQL UPDATE queries without any sanitization or validation. An attacker with access to the product or category add/edit functionality in the PrestaShop backoffice can inject arbitrary SQL, potentially allowing unauthorized access to and modification of database contents.

This issue was fixed in versions: 9.0.8 and 8.1.12

Credits

We thank Krzysztof Winiarski for the responsible vulnerability report.

---

More about the coordinated vulnerability disclosure process at CERT Polska can be found at https://cert.pl/en/cvd/.