SQL Injection Vulnerability in Alior Bank's PrestaShop Module

CVE-2026-15600

What is CVE-2026-15600?

The Alior Bank PrestaShop module 'raty' is susceptible to an SQL Injection vulnerability in the toggleCategoryPromotionAction method. This occurs because the module improperly handles input from the POST parameter 'status', directly inserting it into SQL UPDATE queries without adequate sanitization or validation. Consequently, an attacker with access to the back-office functionality to add or edit products or categories can exploit this flaw to execute arbitrary SQL commands, leading to unauthorized access to and potential alteration of sensitive database content.

References