CVE-2026-7848

Alior Bank's 'raty' installment-payment module for PrestaShop contains a SQL injection flaw (CVSS 4.0: 8.6) in the hookActionObjectProductUpdateBefore, hookActionObjectCategoryUpdateBefore, and hookActionObjectCategoryAddAfter hook methods, which run when a product or category is saved in the backoffice. The module inserts the POST parameters alior_product_promotion, alior_category_promotion, and alior_category_enabled directly into SQL UPDATE queries with no sanitization or validation. An attacker with access to the product or category add/edit functionality — for example a low-privilege employee account with catalog permissions — can inject arbitrary SQL and read or modify database contents, including customer, order, and administrative data. Affected deployments are PrestaShop shops running the module in versions prior to 8.1.11 or 9.0.7, most plausibly merchants in Poland offering Alior Bank installment payments. No public proof of concept or in-the-wild exploitation is known, and the issue is not listed in the CISA KEV catalog.

What to do: Update the raty module to 9.0.7 or 8.1.11, matching the version line you run, and disable or remove the module until the patch is applied. Restrict backoffice rights to add or edit products and categories to trusted staff, since that level of access is required to trigger the injection. Review database audit logs, admin accounts, and catalog records for signs of unexpected UPDATE queries or unauthorized data changes.