SQL Injection Vulnerability in PrestaShop Module by Alior Bank
CVE-2026-7848

8.6HIGH

Key Information:

Vendor

Alior Bank

Status
Raty
Vendor
CVE Published:
14 September 2026

What is CVE-2026-7848?

The PrestaShop module 'raty' created by Alior Bank is susceptible to an SQL Injection vulnerability due to improper handling of POST parameters in several hook methods. Specifically, the methods 'hookActionObjectProductUpdateBefore', 'hookActionObjectCategoryUpdateBefore', and 'hookActionObjectCategoryAddAfter' allow unsanitized data from the request to be injected directly into SQL UPDATE queries. An attacker with access to the product or category management section in the PrestaShop back office can exploit this flaw to execute arbitrary SQL commands, which could lead to unauthorized data manipulation and access. This vulnerability was addressed and resolved in versions 9.0.7 and 8.1.11.

Affected Version(s)

raty 8.0.0 < 8.1.11

raty 9.0.0 < 9.0.7

References

https://www.aliorbank.pl/klienci-indywidualni/kredyty-i-p...
product
https://cert.pl/posts/2026/09/CVE-2026-7848
third-party-advisory

CVSS V4

Score:
8.6
Severity:
HIGH
Confidentiality:
High
Integrity:
High
Availability:
Low
Attack Vector:
Network
Attack Complexity:
Low
Attack Required:
None
Privileges Required:
Undefined
User Interaction:
None

Timeline

  • Vulnerability published

  • Vulnerability Reserved

Credit

K. Winiarski <kwiniarski93@proton.me>
.