Read the docs
TI-2026-06906 Aliases CVE-2026-7848GHSA-2j6v-h3gj-mm3r

SQL Injection in Alior Bank raty PrestaShop module

Priority LOW 39CWE-89Published · Updated

Key facts

Attack vector
Network
Privileges required
High
User interaction
None
Attack complexity
Low
Attack requirements
None
Impact type
SQL injection
Confidentiality · integrity · availability
High · High · Low
Fix status
Fixed

Attack profile from CVSS 4.0 · CNA. Fix status from CNA. Impact type from CWE-89.

Summary

Alior Bank PrestaShop module "raty" for commercial partners is vulnerable to SQL Injection in the "hookActionObjectProductUpdateBefore", "hookActionObjectCategoryUpdateBefore", and "hookActionObjectCategoryAddAfter" hook methods. The module inserts values of the POST parameters "alior_product_promotion",  "alior_category_promotion" and "alior_category_enabled" directly into SQL UPDATE queries without any sanitization or validation. An attacker with access to the product or category add/edit functionality in the PrestaShop backoffice can inject arbitrary SQL, potentially allowing unauthorized access to and modification of database contents. This issue was fixed in versions: 9.0.7 and 8.1.11

Why it matters now

Exploitation None reported CISA SSVC · not in CISA KEV
EPSS 0.00383 32nd percentileScored 2026-11-07
Fix Fixed raty (Alior Bank): 8.1.11, 9.0.7

SSVC decision points

CISA ADP · SSVC 2.0.3

Exploitation
None
Automatable
No
Technical impact
Total

The decision (Track, Attend, Act) also depends on your mission and well-being impact; see CISA's SSVC guide.

Affected products

VendorProductAffected versionsFixed inStatusSource
Alior Bankraty8.0.0 to before 8.1.11; 9.0.0 to before 9.0.78.1.11, 9.0.7Patch availableCNA
  • raty VendorAlior Bank Affected 8.0.0 to before 8.1.11; 9.0.0 to before 9.0.7 Fixed in 8.1.11, 9.0.7 Patch available CNA

Remediation

  • Fix · CNA raty (Alior Bank) Fixed in 8.1.11, 9.0.7

Timeline

  1. 2026-10-02 Threatist record created from CVE-2026-7848
  2. 2026-10-03 Alias added: GHSA-2j6v-h3gj-mm3r

References

Advisory 1

Other 1

  • TI-2026-13124 SQL Injection in Alior Bank raty PrestaShop module CVSS 4.0HIGH 8.6

Sources

This product uses the NVD API but is not endorsed or certified by the NVD. Sources and licences