Full Report
CERT Polska has received a report about 2 SQL Injection vulnerabilities (CVE-2026-7848 and CVE-2026-15600) found in Alior Bank "raty" module for PrestaShop.
Analysis Summary
# Vulnerability: SQL Injection in Alior Bank "raty" Module for PrestaShop
## CVE Details
- **CVE ID:** CVE-2026-7848
- **CVSS Score:** Not explicitly provided in the source (Typically High for SQLi)
- **CWE:** CWE-89 (Improper Neutralization of Special Elements used in an SQL Command)
- **CVE ID:** CVE-2026-15600
- **CVSS Score:** Not explicitly provided in the source (Typically High for SQLi)
- **CWE:** CWE-89 (Improper Neutralization of Special Elements used in an SQL Command)
## Affected Systems
- **Products:** Alior Bank "raty" (Installment) module for PrestaShop.
- **Versions:**
- **CVE-2026-7848:** Versions 8.0.0 through 8.1.11.
- **CVE-2026-15600:** Versions 8.1.9 through 8.1.12.
- **Configurations:** Systems where the module is installed and an attacker has access to the PrestaShop backoffice (Admin panel) with permissions to add/edit products or categories.
## Vulnerability Description
The Alior Bank "raty" module fails to sanitize or validate specific POST parameters before inserting them directly into SQL UPDATE queries.
- **CVE-2026-7848:** Flaws exist in the `hookActionObjectProductUpdateBefore`, `hookActionObjectCategoryUpdateBefore`, and `hookActionObjectCategoryAddAfter` hook methods. The vulnerable parameters are `alior_product_promotion`, `alior_category_promotion`, and `alior_category_enabled`.
- **CVE-2026-15600:** A flaw exists in the `toggleCategoryPromotionAction` method via the `status` POST parameter.
## Exploitation
- **Status:** PoC availability not confirmed; reported via responsible disclosure (CVD). No current reports of exploitation in the wild.
- **Complexity:** Medium (Requires authenticated access to the backoffice).
- **Attack Vector:** Network (Authenticated access to the PrestaShop management interface).
## Impact
- **Confidentiality:** High (Unauthorized access to database contents, including customer and shop data).
- **Integrity:** High (Ability to modify or delete database records).
- **Availability:** High (Potential for database corruption or denial of service).
## Remediation
### Patches
It is recommended to update the module to the latest available versions immediately:
- **For CVE-2026-7848:** Fixed in versions **9.0.7** and **8.1.11**.
- **For CVE-2026-15600:** Fixed in versions **9.0.8** and **8.1.12**.
### Workarounds
- Restrict access to the PrestaShop backoffice to trusted IP addresses only.
- Implement a Web Application Firewall (WAF) with rules to detect and block SQL injection patterns.
- Audit backoffice user permissions to ensure only necessary personnel can edit products or categories.
## Detection
- **Indicators of Compromise:** Review web server logs for suspicious POST requests to category/product management endpoints containing SQL syntax (e.g., `'`, `--`, `UNION`, `SLEEP`).
- **Detection methods and tools:** Database activity monitoring for unexpected `UPDATE` queries or unauthorized access to sensitive tables.
## References
- CERT Polska Advisory: hxxps[://]cert[.]pl/en/posts/2026/09/ali-raty/ (Based on source date)
- CVE-2026-7848: hxxps[://]www[.]cve[.]org/CVERecord?id=CVE-2026-7848
- CVE-2026-15600: hxxps[://]www[.]cve[.]org/CVERecord?id=CVE-2026-15600
- CERT Polska CVD Policy: hxxps[://]cert[.]pl/en/cvd/