VORANT. Threat Intelligence Sign in Get the full feed

SQLi Flaws Patched in Alior Bank PrestaShop Module

routine vulnerability retailfinancial-services

Two SQL injection vulnerabilities in Alior Bank's 'raty' PrestaShop payment module allowed authenticated backoffice users to inject arbitrary SQL via unsanitized POST parameters.

CERT Polska coordinated disclosure of two SQL injection vulnerabilities affecting the Alior Bank 'raty' (installment payment) module for PrestaShop, used by commercial partners integrating Alior Bank financing options into their e-commerce backend. CVE-2026-7848 affects the hookActionObjectProductUpdateBefore, hookActionObjectCategoryUpdateBefore, and hookActionObjectCategoryAddAfter hook methods, where POST parameters (alior_product_promotion, alior_category_promotion, alior_category_enabled) are concatenated directly into SQL UPDATE statements without sanitization. CVE-2026-15600 affects the toggleCategoryPromotionAction method, where the POST parameter 'status' is similarly injected unsanitized into an UPDATE query.

Both vulnerabilities require an attacker to have access to the product or category add/edit functionality in the PrestaShop backoffice, meaning exploitation requires at least some authenticated access to the admin panel — this is not a pre-auth or unauthenticated remote attack. However, given backoffice access (e.g., a compromised low-privilege merchant employee account, or a malicious insider), an attacker could execute arbitrary SQL, potentially reading or modifying database contents including customer, order, and payment configuration data.

No evidence of in-the-wild exploitation is mentioned in the report; this was a responsibly disclosed finding by researcher Krzysztof Winiarski, coordinated through CERT Polska's CVD process. Fixes are available: CVE-2026-7848 is patched in module versions 9.0.7 and 8.1.11; CVE-2026-15600 is patched in versions 9.0.8 and 8.1.12. Defenders running PrestaShop stores with the Alior Bank raty module should upgrade immediately to the patched versions and audit backoffice account access controls and logs for anomalous product/category update requests containing SQL metacharacters in the named POST parameters.

Mentioned in this report

Vulnerabilities CVE-2026-15600CVE-2026-7848

Detection guidance

PrestaShop Backoffice SQL Error Responses Following Product/Category Updates

ATT&CK T1190

Detects HTTP responses with SQL error messages following POST requests to PrestaShop product/category management endpoints, indicating potential SQL injection exploitation attempt. Auto-generated starting point — validate and tune in your environment before deploying. IOC matches can false-positive on shared infrastructure and decay as adversary infrastructure rotates.

title: PrestaShop Backoffice SQL Error Responses Following Product/Category Updates
description: Detects HTTP error responses containing SQL syntax errors or MySQL-specific
  error strings returned after POST requests to PrestaShop admin product/category
  update endpoints, indicative of SQL injection probing via the Alior Bank raty module.
tags:
- attack.t1190
logsource:
  category: proxy
  product: windows
detection:
  selection_request:
    http_method: POST
    http_uri|contains:
    - admin/index.php
    - controller=AdminProducts
    - controller=AdminCategories
  selection_response:
    http_response_status:
    - 500
    - 502
    - 503
    http_response_body|contains:
    - SQL syntax
    - MySQL
    - Uncaught PDOException
    - Query error
    - Fatal error
  filter_generic_errors:
    http_response_body|contains:
    - memory_limit
    - Maximum execution time
  condition: selection_request and selection_response and not filter_generic_errors
falsepositives:
- Legitimate database connectivity issues unrelated to SQL injection
- Generic PHP fatal errors from unrelated module conflicts
level: low
id: 1ca26a61-af72-55e1-aef8-4cf888f8ec86
status: experimental
author: Vorant

Behavioural rules are generated from public reporting — validate in your environment before deploying.

Source reporting: https://cert.pl/en/posts/2026/09/CVE-2026-7848

This is the public brief

Subscribers see the full picture: extracted IOCs, ready-to-deploy detections (Sigma, Splunk, KQL, Elastic, YARA, Suricata), the entity graph, TAXII 2.1 feed and real-time alerts matched to your sectors.

Start free