Alior Bank PrestaShop module “raty”\u00a0for commercial partners is vulnerable to SQL Injection in the “hookActionObjectProductUpdateBefore”, “hookActionObjectCategoryUpdateBefore”, and “hookActionObjectCategoryAddAfter” hook methods. The module inserts values of the POST parameters “alior_product_promotion”,\u00a0 “alior_category_promotion” and “alior_category_enabled”\u00a0directly into SQL UPDATE queries without any sanitization or validation. An attacker with access to the product or category add\/edit functionality in the PrestaShop backoffice can inject arbitrary SQL, potentially allowing unauthorized access to and modification of database contents.\u00a0This issue was fixed in versions:\u00a09.0.7 and 8.1.11<\/p>\n","protected":false},"excerpt":{"rendered":"
Alior Bank PrestaShop module “raty”\u00a0for commercial partners is vulnerable to SQL Injection in the “hookActionObjectProductUpdateBefore”, “hookActionObjectCategoryUpdateBefore”, and “hookActionObjectCa<\/p>\n","protected":false},"template":"","meta":[],"categories":[],"tags":[],"class_list":["post-22309","vuln","type-vuln","status-publish","hentry"],"_links":{"self":[{"href":"https:\/\/www.54iter.cn\/index.php?rest_route=\/wp\/v2\/vuln\/22309","targetHints":{"allow":["GET"]}}],"collection":[{"href":"https:\/\/www.54iter.cn\/index.php?rest_route=\/wp\/v2\/vuln"}],"about":[{"href":"https:\/\/www.54iter.cn\/index.php?rest_route=\/wp\/v2\/types\/vuln"}],"wp:attachment":[{"href":"https:\/\/www.54iter.cn\/index.php?rest_route=%2Fwp%2Fv2%2Fmedia&parent=22309"}],"wp:term":[{"taxonomy":"category","embeddable":true,"href":"https:\/\/www.54iter.cn\/index.php?rest_route=%2Fwp%2Fv2%2Fcategories&post=22309"},{"taxonomy":"post_tag","embeddable":true,"href":"https:\/\/www.54iter.cn\/index.php?rest_route=%2Fwp%2Fv2%2Ftags&post=22309"}],"curies":[{"name":"wp","href":"https:\/\/api.w.org\/{rel}","templated":true}]}}