Alior Bank Raty CVE-2026-7848

Exploitation requires an authenticated PrestaShop backoffice session with at minimum the ability to add or edit products or categories (standard shop manager or administrator role). The 'raty' module must be installed and active on the store. The three exploitable parameters (alior_product_promotion, alior_category_promotion, alior_category_enabled) are submitted via POST to the standard PrestaShop backoffice product/category save endpoints. No special network position, protocol configuration, or non-default server setting is needed beyond legitimate backoffice access. Exploitation is not automatable per SSVC, as it depends on interactive backoffice session mechanics. It is limited by the PR:H requirement: unauthenticated external attackers cannot reach the injection points without first compromising admin credentials.

The CVSS 4.0 vector (AV:N/AC:L/AT:N/PR:H/UI:N/VC:H/VI:H/VA:L) scores 8.6, reflecting high confidentiality and integrity impact but gated firmly behind PR:H - full backoffice admin credentials. SSVC corroborates this: Exploitation status is none, Automatable is no, and Technical Impact is total. The combination of high privilege requirement and non-automatable exploitation substantially lowers real-world priority compared to the raw score: the vulnerability cannot be mass-exploited by unauthenticated actors and requires a meaningful initial access step. Even a mid-sized municipal IT team in kielce running an Alior Bank partner storefront should treat this as urgent but not emergency-tier patching - the primary threat actors are compromised or malicious insiders with existing admin access, not opportunistic internet scanners. The 'Authentication Bypass' tag in the input data appears incorrect (see data_quality_flags); the vulnerability does not bypass authentication, it exploits privileges already held. No KEV listing and no public POC have been identified, consistent with the low automated-exploitation likelihood.

An attacker who has obtained PrestaShop backoffice credentials - through phishing, credential stuffing, or a compromised internal account - navigates to a product or category edit page and submits a crafted form with a SQL payload embedded in the alior_product_promotion field. The module's hook method passes this value unescaped into an UPDATE query, allowing the attacker to append additional SQL clauses that dump the customer table or alter admin account credentials.