CVE-2026-7848
Received Received - Intake

SQL Injection in Alior Bank PrestaShop Raty Module

Publication date: 2026-09-14

Last updated on: 2026-09-14

Assigner: CERT.PL

Description
Alior Bank PrestaShop module "raty" for commercial partners is vulnerable to SQL Injection in the "hookActionObjectProductUpdateBefore", "hookActionObjectCategoryUpdateBefore", and "hookActionObjectCategoryAddAfter" hook methods. The module inserts values of the POST parameters "alior_product_promotion",  "alior_category_promotion" and "alior_category_enabled" directly into SQL UPDATE queries without any sanitization or validation. An attacker with access to the product or category add/edit functionality in the PrestaShop backoffice can inject arbitrary SQL, potentially allowing unauthorized access to and modification of database contents. This issue was fixed in versions: 9.0.7 and 8.1.11

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published
2026-09-14
Last Modified
2026-09-14
Generated
2026-09-15
AI Q&A
2026-09-14
EPSS Evaluated
N/A
NVD
CVE-2026-7848
EUVD
EUVD-2026-77518

Affected Vendors & Products

Showing 6 associated CPEs
Vendor Product Version / Range
alior_bank presta_shop_module 9.0.7
alior_bank presta_shop_module 8.1.11
alior_bank raty 9.0.7
alior_bank raty 8.1.11
alior_bank raty 9.0.8
alior_bank raty 8.1.12

Helpful Resources

Exploitability

CWE
CWE Icon
KEV
KEV Icon
CWE ID Description
CWE-89 The product constructs all or part of an SQL command using externally-influenced input from an upstream component, but it does not neutralize or incorrectly neutralizes special elements that could modify the intended SQL command when it is sent to a downstream component. Without sufficient removal or quoting of SQL syntax in user-controllable inputs, the generated SQL query can cause those inputs to be interpreted as SQL instead of ordinary user data.

Attack-Flow Graph

AI Quick Actions

Instant insights powered by AI
Executive Summary

This vulnerability is a SQL Injection flaw in the Alior Bank PrestaShop module 'raty' affecting commercial partners. It exists in three hook methods where POST parameters are directly inserted into SQL UPDATE queries without sanitization. An attacker with access to product or category add/edit functions in PrestaShop backoffice can inject malicious SQL code, potentially allowing unauthorized database access and modifications.

Detection Guidance

To detect this SQL Injection vulnerability, monitor POST requests to PrestaShop admin endpoints for the parameters alior_product_promotion, alior_category_promotion, and alior_category_enabled. Check for unusual SQL syntax in these parameters or errors in application logs.

Impact Analysis

An attacker could exploit this to gain unauthorized access to sensitive data in the database, modify or delete information, or execute administrative operations. This could lead to data breaches, financial fraud, or disruption of services if the database is corrupted. The impact depends on the database contents and the attacker's goals.

Compliance Impact

This vulnerability could lead to non-compliance with GDPR (data protection) and HIPAA (health data protection) by enabling unauthorized access to or modification of sensitive personal or health data. Organizations may face legal penalties, fines, or reputational damage if such breaches occur due to inadequate security measures.

Mitigation Strategies

Immediately update the Alior Bank PrestaShop module to version 9.0.7 or 8.1.11 (or later). If you cannot update, restrict access to the PrestaShop admin panel and disable product/category add/edit functionality until patched.

Chat Assistant

Ask questions about this CVE
Hi! I’m here to help you understand CVE-2026-7848. Ask me anything about the vulnerability, its impact, or mitigation strategies.
0/70

EPSS Chart