CVE-2026-15600
Received Received - Intake

SQL Injection in Alior Bank PrestaShop Raty Module

Publication date: 2026-09-14

Last updated on: 2026-09-14

Assigner: CERT.PL

Description
Alior Bank PrestaShop module "raty" for commercial partners is vulnerable to SQL Injection in the toggleCategoryPromotionAction method. The module inserts value of the POST parameter "status" into SQL UPDATE queries without any sanitization or validation. An attacker with access to the product or category add/edit functionality in the PrestaShop backoffice can inject arbitrary SQL, potentially allowing unauthorized access to and modification of database contents.

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published
2026-09-14
Last Modified
2026-09-14
Generated
2026-09-15
AI Q&A
2026-09-14
EPSS Evaluated
N/A
NVD
CVE-2026-15600
EUVD
EUVD-2026-77519

Affected Vendors & Products

Showing 4 associated CPEs
Vendor Product Version / Range
alior_bank raty 9.0.7
alior_bank raty 8.1.11
alior_bank raty 9.0.8
alior_bank raty 8.1.12

Helpful Resources

Exploitability

CWE
CWE Icon
KEV
KEV Icon
CWE ID Description
CWE-89 The product constructs all or part of an SQL command using externally-influenced input from an upstream component, but it does not neutralize or incorrectly neutralizes special elements that could modify the intended SQL command when it is sent to a downstream component. Without sufficient removal or quoting of SQL syntax in user-controllable inputs, the generated SQL query can cause those inputs to be interpreted as SQL instead of ordinary user data.

Attack-Flow Graph

AI Quick Actions

Instant insights powered by AI
Executive Summary

This vulnerability is a SQL Injection flaw in the Alior Bank PrestaShop module 'raty' for commercial partners. It occurs in the toggleCategoryPromotionAction method where the POST parameter 'status' is directly inserted into SQL UPDATE queries without sanitization or validation. This allows attackers with backoffice access to inject malicious SQL code.

Detection Guidance

To detect this SQL injection vulnerability in the Alior Bank PrestaShop module 'raty', inspect PrestaShop backoffice access logs for suspicious POST requests to the toggleCategoryPromotionAction method containing the 'status' parameter. Check for unusual SQL query patterns or errors in database logs. No specific commands are provided in the context.

Impact Analysis

An attacker could exploit this to execute arbitrary SQL commands, potentially leading to unauthorized access, data theft, or modification of database contents. This could compromise sensitive information like customer data, financial records, or product details stored in the PrestaShop database.

Compliance Impact

This vulnerability could lead to non-compliance with GDPR and HIPAA by exposing or allowing unauthorized modification of personal or sensitive data. GDPR requires protection of personal data, while HIPAA mandates safeguards for protected health information. A breach could result in legal penalties and reputational damage.

Mitigation Strategies

Immediately update the Alior Bank PrestaShop module 'raty' to the latest patched version. If no patch is available, disable the module temporarily. Ensure all PrestaShop backoffice users with product/category access follow strict input validation practices. Monitor database activity for unauthorized changes.

Chat Assistant

Ask questions about this CVE
Hi! I’m here to help you understand CVE-2026-15600. Ask me anything about the vulnerability, its impact, or mitigation strategies.
0/70

EPSS Chart