SQLi Flaws Patched in Alior Bank PrestaShop Module
Two SQL injection vulnerabilities in Alior Bank's 'raty' PrestaShop payment module allowed authenticated backoffice users to inject arbitrary SQL via unsanitized POST parameters.
CERT Polska coordinated disclosure of two SQL injection vulnerabilities affecting the Alior Bank 'raty' (installment payment) module for PrestaShop, used by commercial partners integrating Alior Bank financing options into their e-commerce backend. CVE-2026-7848 affects the hookActionObjectProductUpdateBefore, hookActionObjectCategoryUpdateBefore, and hookActionObjectCategoryAddAfter hook methods, where POST parameters (alior_product_promotion, alior_category_promotion, alior_category_enabled) are concatenated directly into SQL UPDATE statements without sanitization. CVE-2026-15600 affects the toggleCategoryPromotionAction method, where the POST parameter 'status' is similarly injected unsanitized into an UPDATE query.
Both vulnerabilities require an attacker to have access to the product or category add/edit functionality in the PrestaShop backoffice, meaning exploitation requires at least some authenticated access to the admin panel — this is not a pre-auth or unauthenticated remote attack. However, given backoffice access (e.g., a compromised low-privilege merchant employee account, or a malicious insider), an attacker could execute arbitrary SQL, potentially reading or modifying database contents including customer, order, and payment configuration data.
No evidence of in-the-wild exploitation is mentioned in the report; this was a responsibly disclosed finding by researcher Krzysztof Winiarski, coordinated through CERT Polska's CVD process. Fixes are available: CVE-2026-7848 is patched in module versions 9.0.7 and 8.1.11; CVE-2026-15600 is patched in versions 9.0.8 and 8.1.12. Defenders running PrestaShop stores with the Alior Bank raty module should upgrade immediately to the patched versions and audit backoffice account access controls and logs for anomalous product/category update requests containing SQL metacharacters in the named POST parameters.
Mentioned in this report
Detection guidance
PrestaShop Backoffice SQL Error Responses Following Product/Category Updates
Detects HTTP responses with SQL error messages following POST requests to PrestaShop product/category management endpoints, indicating potential SQL injection exploitation attempt. Auto-generated starting point — validate and tune in your environment before deploying. IOC matches can false-positive on shared infrastructure and decay as adversary infrastructure rotates.
title: PrestaShop Backoffice SQL Error Responses Following Product/Category Updates
description: Detects HTTP error responses containing SQL syntax errors or MySQL-specific
error strings returned after POST requests to PrestaShop admin product/category
update endpoints, indicative of SQL injection probing via the Alior Bank raty module.
tags:
- attack.t1190
logsource:
category: proxy
product: windows
detection:
selection_request:
http_method: POST
http_uri|contains:
- admin/index.php
- controller=AdminProducts
- controller=AdminCategories
selection_response:
http_response_status:
- 500
- 502
- 503
http_response_body|contains:
- SQL syntax
- MySQL
- Uncaught PDOException
- Query error
- Fatal error
filter_generic_errors:
http_response_body|contains:
- memory_limit
- Maximum execution time
condition: selection_request and selection_response and not filter_generic_errors
falsepositives:
- Legitimate database connectivity issues unrelated to SQL injection
- Generic PHP fatal errors from unrelated module conflicts
level: low
id: 1ca26a61-af72-55e1-aef8-4cf888f8ec86
status: experimental
author: Vorant
Behavioural rules are generated from public reporting — validate in your environment before deploying.
Source reporting: https://cert.pl/en/posts/2026/09/CVE-2026-7848
This is the public brief
Subscribers see the full picture: extracted IOCs, ready-to-deploy detections (Sigma, Splunk, KQL, Elastic, YARA, Suricata), the entity graph, TAXII 2.1 feed and real-time alerts matched to your sectors.
Start free