AIKIDO-2026-250803

TL;DR

The ProductCommentCriterionRepository builds the SQL INSERT statements that link review criteria to categories and products by concatenating the submitted category and product IDs directly into the query string. A back-office employee with access to the product comments module configuration page can submit a crafted category or product ID that breaks out of the query and injects arbitrary SQL. Successful injection lets that user read, modify, or destroy arbitrary data in the shop database. The fix casts the IDs to integers and binds them as parameters instead of concatenating them into the query.