CVE-2026-15600 Alior Bank CVE debrief

Who should care

PrestaShop users with the 'raty' module installed, particularly those with access to the product or category add/edit functionality in the PrestaShop backoffice, should review and update the module to the latest version, implement input validation and sanitization, and monitor for suspicious activity. Affected operators, platforms, vulnerability-management, and security teams should also be aware of the potential risks and take necessary precautions.

Why it matters

CVE-2026-15600 is a SQL Injection vulnerability in the 'raty' module for PrestaShop used by Alior Bank. The vulnerability allows an attacker with access to the PrestaShop backoffice to inject arbitrary SQL code, potentially leading to unauthorized access and modification of database contents. PrestaShop users with the 'raty' module installed should review and update the module to the latest version, implement input validation and sanitization, and monitor for suspicious activity.

• Potential unauthorized access to and modification of database contents.
• Possible injection of arbitrary SQL code.
• Required verification of affected versions and remediation.

Technical summary

The 'raty' module for PrestaShop used by Alior Bank is vulnerable to SQL Injection in the toggleCategoryPromotionAction method. The module inserts the value of the POST parameter 'status' into SQL UPDATE queries without any sanitization or validation, allowing an attacker with access to the PrestaShop backoffice to inject arbitrary SQL code, potentially leading to unauthorized access and modification of database contents. PrestaShop users with the 'raty' module installed should review and update the module to the latest version, implement input validation and sanitization, and monitor for suspicious activity.

Defensive priority

High priority for PrestaShop users with the 'raty' module installed.

Recommended defensive actions

• Review and update the 'raty' module to the latest version.
• Implement input validation and sanitization for the 'status' parameter.
• Monitor for suspicious activity on the PrestaShop backoffice.
• Confirm whether affected product deployments exist in managed environments and assign an owner for follow-up.
• Review compensating controls for exposed systems while remediation is scheduled and verified.
• Check relevant monitoring, detection, and logs for exposed assets that need extra review.
• Track exceptions, retest remediated assets, and close the item only after evidence is documented.

Evidence notes

The CVE record and NVD entry provide details on the SQL Injection vulnerability in the 'raty' module for PrestaShop used by Alior Bank for commercial partners. The vulnerability allows an attacker with access to the PrestaShop backoffice to inject arbitrary SQL code, potentially leading to unauthorized access and modification of database contents. The module inserts the value of the POST parameter 'status' into SQL UPDATE queries without any sanitization or validation.

Sources and references

Methodology and review provenance

AI-assisted synthesis based on stored public vulnerability evidence. System validation, approval state, and publication status do not by themselves establish human review of this revision. PatchSiren helps prioritize defensive review and does not prove exposure or remediation on any system.