What’s Vulnerable › Vulnerabilities

CVE-2026-7848: SQL Injection in Alior Bank raty PrestaShop module

• Severity: high (CVSS 8.6 v4.0)
• Exploited in the wild: not listed in CISA KEV
• EPSS: 0.4% probability of exploitation in the next 30 days
• Public exploit or detection template: none known
• Published: 2026-09-14 · updated 2026-09-18
• Weakness: CWE-89

Description

Alior Bank PrestaShop module "raty" for commercial partners is vulnerable to SQL Injection in the "hookActionObjectProductUpdateBefore", "hookActionObjectCategoryUpdateBefore", and "hookActionObjectCategoryAddAfter" hook methods. The module inserts values of the POST parameters "alior_product_promotion",  "alior_category_promotion" and "alior_category_enabled" directly into SQL UPDATE queries without any sanitization or validation. An attacker with access to the product or category add/edit functionality in the PrestaShop backoffice can inject arbitrary SQL, potentially allowing unauthorized access to and modification of database contents. This issue was fixed in versions: 9.0.7 and 8.1.11

Affected products

• Alior Bank raty: from 8.0.0 before 8.1.11; from 9.0.0 before 9.0.7 — fixed in 8.1.11, 9.0.7

How to fix

Upgrade to a fixed version: Alior Bank raty 8.1.11, 9.0.7. Check the vendor advisory for mitigations.

References

• https://cert.pl/posts/2026/09/CVE-2026-7848
• https://www.aliorbank.pl/klienci-indywidualni/kredyty-i-pozyczki/kredyty-ratalne/informacje-dla-partnerow-handlowych.html

Get alerted when CVE-2026-7848 or the next vulnerability affects your stack