CVE-2026-15600

The Alior Bank 'raty' installment module for PrestaShop (distributed to the bank's commercial partners) contains a SQL injection flaw in its toggleCategoryPromotionAction method, where the raw value of the POST parameter 'status' is inserted into SQL UPDATE queries without any sanitization or validation. An attacker who already has access to product or category add/edit functionality in the PrestaShop backoffice can submit a crafted 'status' value to inject and execute arbitrary SQL. Successful exploitation allows unauthorized reading and modification of the shop's database contents, including sensitive customer and order data, which is reflected in a CVSS 4.0 score of 8.6 (high). Affected sites are PrestaShop stores running this module, which is only offered to Alior Bank commercial partners — predominantly Polish merchants offering Alior installment payments. No public proof of concept exists and no exploitation in the wild has been reported; the CVE is not listed in CISA's KEV catalog.

What to do: Contact Alior Bank for a patched version of the 'raty' module and apply it as soon as one is released; if the installment feature is not needed, disable or remove the module in the meantime. Restrict PrestaShop backoffice permissions so that only fully trusted employees can add or edit products and categories, since the flaw requires that level of access. Review database and application logs for anomalous UPDATE queries or unexpected data changes originating from the module's promotion-toggle action.