EUVD-2026-77518
GHSA-2j6v-h3gj-mm3r
Severity by source
CVSS:4.0/AV:N/AC:L/AT:N/PR:H/UI:N/VC:H/VI:H/VA:L/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X
Backoffice admin access required (PR:H); SQL injection yields full DB read/write (C:H/I:H); availability impact is marginal (A:L) since queries modify data rather than deny service.
Primary rating from Vendor (CERT-PL).
CVSS VectorVendor: CERT-PL
Lifecycle Timeline
4DescriptionCVE.org
Alior Bank PrestaShop module "raty" for commercial partners is vulnerable to SQL Injection in the "hookActionObjectProductUpdateBefore", "hookActionObjectCategoryUpdateBefore", and "hookActionObjectCategoryAddAfter" hook methods. The module inserts values of the POST parameters "alior_product_promotion", "alior_category_promotion" and "alior_category_enabled" directly into SQL UPDATE queries without any sanitization or validation. An attacker with access to the product or category add/edit functionality in the PrestaShop backoffice can inject arbitrary SQL, potentially allowing unauthorized access to and modification of database contents. This issue was fixed in versions: 9.0.7 and 8.1.11
AnalysisAI
SQL injection in the Alior Bank 'raty' PrestaShop module (versions 8.0.0-8.1.10 and 9.0.0-9.0.6) permits authenticated backoffice users to inject arbitrary SQL through three unsanitized POST parameters embedded directly in UPDATE queries across product and category hook methods. Successful exploitation enables unauthorized read and modification of the underlying store database, including customer records and sensitive configuration data. …
Unlock full vulnerability intelligence
- Risk assessment & exploitation conditions
- Attack chain visualization
- Remediation with exact patch versions
- Threat intelligence from 22 sources
- Personal watchlist & email alerts
Free forever · No credit card required
Attack ChainAIDerived
Hypothetical attack flow derived from CVE metadata
Vulnerability AssessmentAI
| Exploitation | Exploitation requires an authenticated PrestaShop backoffice session with at minimum the ability to add or edit products or categories (standard shop manager or administrator role). … Additional conditions and limiting factors are described in the full assessment. |
| Risk Assessment | The CVSS 4.0 vector (AV:N/AC:L/AT:N/PR:H/UI:N/VC:H/VI:H/VA:L) scores 8.6, reflecting high confidentiality and integrity impact but gated firmly behind PR:H - full backoffice admin credentials. … Full risk analysis with EPSS, KEV, and SSVC signal comparison available after sign-in. |
| Exploit Scenario | Full exploit scenario with step-by-step reproduction available after sign-in. |
| Remediation | Upgrade the 'raty' module to version 8.1.11 (for 8.x branch deployments) or 9.0.7 (for 9.x branch deployments), which contain the vendor-released patch per the CERT-PL advisory at https://cert.pl/posts/2026/09/CVE-2026-7848. … Detailed patch versions, workarounds, and compensating controls in full report. |
Recommended ActionAI
Within 24 hours, inventory all PrestaShop installations using the Alior Bank 'raty' module and identify affected version instances (8.0.0-8.1.10 or 9.0.0-9.0.6); notify key stakeholders and restrict backoffice access where possible. …
Sign in for detailed remediation steps and compensating controls.
Threat intelligence, references, and detailed analysis are available after sign-in.
Same weakness CWE-89 – SQL Injection
View allShare
External POC / Exploit Code
Leaving vuln.today