EUVD-2026-77519
GHSA-673p-mhx8-prcm
Severity by source
CVSS:4.0/AV:N/AC:L/AT:N/PR:H/UI:N/VC:H/VI:H/VA:L/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X
PR:H because exploitation requires authenticated backoffice admin access; C:H/I:H for full database read/write via SQL injection; A:L for limited availability disruption from malformed UPDATE queries.
Primary rating from Vendor (CERT-PL).
CVSS VectorVendor: CERT-PL
Lifecycle Timeline
3DescriptionCVE.org
Alior Bank PrestaShop module "raty" for commercial partners is vulnerable to SQL Injection in the toggleCategoryPromotionAction method. The module inserts value of the POST parameter "status" into SQL UPDATE queries without any sanitization or validation. An attacker with access to the product or category add/edit functionality in the PrestaShop backoffice can inject arbitrary SQL, potentially allowing unauthorized access to and modification of database contents.
AnalysisAI
SQL injection in the Alior Bank 'raty' PrestaShop module's toggleCategoryPromotionAction method allows an authenticated backoffice user with product or category edit privileges to inject arbitrary SQL via the unsanitized POST parameter 'status', which is passed directly into SQL UPDATE queries. Affected versions span two release branches: raty 9.0.5-9.0.7 and 8.1.9-8.1.11, with fixes available in 9.0.8 and 8.1.12 respectively. …
Unlock full vulnerability intelligence
- Risk assessment & exploitation conditions
- Attack chain visualization
- Remediation with exact patch versions
- Threat intelligence from 22 sources
- Personal watchlist & email alerts
Free forever · No credit card required
Attack ChainAIDerived
Hypothetical attack flow derived from CVE metadata
Vulnerability AssessmentAI
| Exploitation | Exploitation requires an authenticated PrestaShop backoffice session with access to the product or category add/edit functionality - this corresponds to PR:H in the CVSS 4.0 vector. … Additional conditions and limiting factors are described in the full assessment. |
| Risk Assessment | The CVSS 4.0 score of 8.6 reflects high confidentiality and integrity impact (VC:H/VI:H) against a low-complexity network attack path, but the PR:H metric is the critical limiter - exploitation requires an already-authenticated PrestaShop backoffice administrator with category or product edit rights, sharply reducing the realistic attack surface compared to what an 8.6 score implies at first glance. … Full risk analysis with EPSS, KEV, and SSVC signal comparison available after sign-in. |
| Exploit Scenario | Full exploit scenario with step-by-step reproduction available after sign-in. |
| Remediation | Upgrade the 'raty' module to version 9.0.8 (if running the 9.0.x branch) or 8.1.12 (if running the 8.1.x branch); these are the vendor-confirmed fixed releases per EUVD-2026-77519. … Detailed patch versions, workarounds, and compensating controls in full report. |
Threat intelligence, references, and detailed analysis are available after sign-in.
Same weakness CWE-89 – SQL Injection
View allSame technique Authentication Bypass
View allShare
External POC / Exploit Code
Leaving vuln.today