Raty
Monthly
SQL injection in the Alior Bank 'raty' PrestaShop module's toggleCategoryPromotionAction method allows an authenticated backoffice user with product or category edit privileges to inject arbitrary SQL via the unsanitized POST parameter 'status', which is passed directly into SQL UPDATE queries. Affected versions span two release branches: raty 9.0.5-9.0.7 and 8.1.9-8.1.11, with fixes available in 9.0.8 and 8.1.12 respectively. No public exploit code has been identified at time of analysis, and SSVC rates exploitation as none with the attack not automatable.
SQL injection in the Alior Bank 'raty' PrestaShop module (versions 8.0.0-8.1.10 and 9.0.0-9.0.6) permits authenticated backoffice users to inject arbitrary SQL through three unsanitized POST parameters embedded directly in UPDATE queries across product and category hook methods. Successful exploitation enables unauthorized read and modification of the underlying store database, including customer records and sensitive configuration data. Fixed in versions 8.1.11 and 9.0.7 per CERT-PL advisory; no public exploit identified at time of analysis.
SQL injection in the Alior Bank 'raty' PrestaShop module's toggleCategoryPromotionAction method allows an authenticated backoffice user with product or category edit privileges to inject arbitrary SQL via the unsanitized POST parameter 'status', which is passed directly into SQL UPDATE queries. Affected versions span two release branches: raty 9.0.5-9.0.7 and 8.1.9-8.1.11, with fixes available in 9.0.8 and 8.1.12 respectively. No public exploit code has been identified at time of analysis, and SSVC rates exploitation as none with the attack not automatable.
SQL injection in the Alior Bank 'raty' PrestaShop module (versions 8.0.0-8.1.10 and 9.0.0-9.0.6) permits authenticated backoffice users to inject arbitrary SQL through three unsanitized POST parameters embedded directly in UPDATE queries across product and category hook methods. Successful exploitation enables unauthorized read and modification of the underlying store database, including customer records and sensitive configuration data. Fixed in versions 8.1.11 and 9.0.7 per CERT-PL advisory; no public exploit identified at time of analysis.