Executive brief
Alior Bank's "raty" module for PrestaShop is a payment integration plugin used by online retailers to offer installment credit to customers. A SQL injection vulnerability allows attackers with backend admin access to inject malicious SQL commands through unsanitized form fields, potentially reading or modifying database records containing customer and transaction data. This could compromise payment processing, customer information, and store integrity.
Technical details
The vulnerability is a classic SQL injection (CWE-89) in three hook methods: hookActionObjectProductUpdateBefore, hookActionObjectCategoryUpdateBefore, and hookActionObjectCategoryAddAfter. The module directly concatenates POST parameters (alior_product_promotion, alior_category_promotion, alior_category_enabled) into SQL UPDATE queries without sanitization or parameterized query use. An authenticated attacker with product or category management permissions in the PrestaShop admin panel can inject arbitrary SQL commands. This allows reading sensitive database contents or modifying product/category data. The vulnerability was patched in versions 8.1.11 and 9.0.7.
Affected products
- Alior Bank raty 8.0.0 to 8.1.10, 9.0.0 to 9.0.6
Timeline
- 2026-09-14: disclosed
- 2026-09-14: patched: Patched in versions 8.1.11 and 9.0.7