A high severity SQL injection vulnerability in the Alior Bank raty PrestaShop module allows an authenticated attacker to compromise database integrity.

The module fails to sanitize the status POST parameter within the toggleCategoryPromotionAction method, leading to SQL injection. Successful exploitation requires an attacker to hold administrative or backoffice privileges to access category management functions.

This vulnerability poses a significant risk to data confidentiality and integrity. An attacker with backoffice access can manipulate SQL queries to view sensitive information or modify records within the PrestaShop database. With a CVSS score of 8.6, this flaw is categorized as high severity and could lead to unauthorized administrative control over the store data if left unpatched.

Immediate Action: Update the Alior Bank raty module to version 8.1.12 or 9.0.8 immediately to apply the necessary input sanitization patches.

Proactive Monitoring: Review database access logs and query history for unusual UPDATE commands or unexpected syntax patterns originating from the backoffice interface.

Compensating Controls: Ensure that administrative access to the PrestaShop backoffice is strictly limited to authorized personnel and protected by multi-factor authentication to reduce the likelihood of malicious exploitation.

Public Exploit Available: No

Given the high severity of this SQL injection flaw, administrators must prioritize updating the raty module to the latest version. Failure to patch allows authenticated users to potentially compromise the entire store database, leading to severe operational and security consequences. Apply the recommended versions immediately to mitigate this risk.