CVE-2026-15600: Alior Bank PrestaShop SQLI Vulnerability

CVE-2026-15600 Overview

CVE-2026-15600 is a SQL Injection vulnerability [CWE-89] in the Alior Bank PrestaShop module raty, distributed to commercial partners. The flaw resides in the toggleCategoryPromotionAction method, which passes the status POST parameter directly into SQL UPDATE statements without sanitization or validation. An authenticated backoffice user with access to the product or category add/edit functionality can inject arbitrary SQL. Successful exploitation allows unauthorized reading and modification of database contents, including customer, order, and administrative data.

Critical Impact

Authenticated backoffice users can execute arbitrary SQL against the PrestaShop database, compromising confidentiality and integrity of e-commerce data.

Affected Products

• Alior Bank PrestaShop module raty for commercial partners
• PrestaShop deployments integrating the raty installment payment module
• Merchant backoffices exposing product or category management to non-administrative staff

Discovery Timeline

• 2026-09-14 - CVE-2026-15600 published to NVD
• 2026-09-18 - Last updated in NVD database

Technical Details for CVE-2026-15600

Vulnerability Analysis

The vulnerability affects the toggleCategoryPromotionAction method within the raty PrestaShop module. This method processes a POST request that toggles a promotion status flag for a category and issues a SQL UPDATE query against the module's data tables.

The status parameter received from the client is concatenated directly into the query string. No type casting, parameter binding, or input sanitization is applied before the query reaches the database driver. Any attacker able to submit the POST request can therefore control part of the raw SQL statement.

Because the injection occurs inside an UPDATE statement, an attacker can extend the query with stacked conditions, subqueries, or CASE expressions to exfiltrate arbitrary data or overwrite fields across other tables. The database user assigned to PrestaShop typically holds full read and write privileges on the store schema, amplifying the impact.

Root Cause

The root cause is missing input validation and the absence of parameterized queries when handling the status POST parameter in toggleCategoryPromotionAction. The module trusts backoffice-supplied input and constructs SQL through string concatenation, a classic instance of [CWE-89] Improper Neutralization of Special Elements used in an SQL Command.

Attack Vector

Exploitation requires an authenticated session in the PrestaShop backoffice with permission to reach product or category add/edit functionality. The attacker submits a crafted POST request in which the status parameter contains SQL syntax rather than a boolean value. The malicious payload is embedded into the UPDATE query executed by the module, enabling data theft, privilege escalation via administrative table modification, or persistence through injected records.

See the CERT Polska advisory for additional technical context and the Alior Bank Partner Information page for module distribution details.

Detection Methods for CVE-2026-15600

Indicators of Compromise

• POST requests to backoffice endpoints invoking toggleCategoryPromotionAction where the status parameter contains non-numeric characters, quotes, comments (--, #, /*), or SQL keywords such as SELECT, UNION, SLEEP, or UPDATE.
• Unexpected changes to PrestaShop administrative accounts, employee records, or order data with no corresponding user-initiated action in the backoffice audit log.
• Database error entries referencing the raty module's UPDATE queries, indicating malformed injected SQL.

Detection Strategies

• Inspect web server and application logs for the toggleCategoryPromotionAction route and flag any status values that are not strictly 0 or 1.
• Deploy WAF rules that block SQL metacharacters and keywords in the status POST parameter for the raty module URI.
• Correlate backoffice authentication events with subsequent bulk data reads or modifications to detect abuse of legitimate accounts.

Monitoring Recommendations

• Enable MySQL general query or audit logging for the PrestaShop database and alert on UPDATE statements referencing tables outside the raty module scope originating from the module's connection.
• Monitor for spikes in 500-level responses on backoffice module endpoints, which often accompany blind SQL injection probing.
• Track backoffice employee account creation, permission changes, and password resets in near real time.

How to Mitigate CVE-2026-15600

Immediate Actions Required

• Restrict backoffice access to trusted IP ranges and enforce multi-factor authentication for all employee accounts with product or category management privileges.
• Review and revoke unnecessary backoffice permissions, ensuring that only vetted staff can reach category promotion functionality.
• Audit the PrestaShop database for unauthorized administrative accounts, altered permissions, and anomalous records created since the module was installed.

Patch Information

Refer to the CERT Polska advisory for CVE-2026-7848 and the Alior Bank Partner Information page for the current fixed release of the raty module. Update to the vendor-provided patched version distributed through Alior Bank's partner channel and rotate any credentials that may have been exposed.

Workarounds

• Disable the raty module in the PrestaShop backoffice until a patched version is installed.
• Deploy a WAF rule that rejects requests to toggleCategoryPromotionAction when the status parameter is not a single digit (0 or 1).
• Apply least-privilege database credentials to the PrestaShop application user, removing rights to modify sensitive tables such as ps_employee where operationally feasible.

# Example ModSecurity rule to constrain the status parameter
SecRule REQUEST_URI "@contains toggleCategoryPromotionAction" \
    "phase:2,chain,deny,status:403,id:1026156000,\
     msg:'CVE-2026-15600: invalid status parameter for raty module'"
    SecRule ARGS:status "!@rx ^[01]$" "t:none"