The Alior Bank raty module for PrestaShop contains a high-severity SQL injection vulnerability that allows authenticated administrative users to compromise database integrity.

This vulnerability is a SQL injection flaw (CWE-89) triggered by the failure to sanitize POST parameters in the hookActionObjectProductUpdateBefore, hookActionObjectCategoryUpdateBefore, and hookActionObjectCategoryAddAfter methods. An attacker must possess authenticated access to the PrestaShop backoffice to exploit these parameters.

Successful exploitation of this vulnerability permits an attacker to perform unauthorized SQL operations, including the modification or exfiltration of sensitive database records. With a CVSS score of 8.6, this flaw presents a significant risk to data confidentiality and integrity, potentially leading to unauthorized administrative access or the corruption of business-critical e-commerce data.

Immediate Action: Update the Alior Bank raty module to version 8.1.11 or 9.0.7 immediately to incorporate the necessary input sanitization.

Proactive Monitoring: Review database audit logs for suspicious UPDATE or injection-style queries originating from the PrestaShop backoffice administrative user accounts.

Compensating Controls: Implement a Web Application Firewall (WAF) rule to inspect and block malicious SQL syntax within POST requests targeting the affected module's hook parameters.

Public Exploit Available: No

Given the severity of the potential impact on database integrity, organizations using the Alior Bank raty module must prioritize upgrading to the patched versions. Ensure that administrative access to the PrestaShop backoffice is restricted to authorized personnel only and that all security patches are applied as part of a regular maintenance cycle to mitigate the risk of exploitation.