CVE-2023-46350 is a critical severity (CVSS 9.8) SQL injection in the InnovaDeluxe idxrmanufacturer module for PrestaShop, up to version 2.0.4. A guest can trigger it without login. Upgrade to 2.0.5, which fixes it. A patch is also provided for 2.0.3.
What's affected
The record and the Friends of Presta advisory both say the "Manufacturer or supplier alphabetical search" module (idxrmanufacturer) is affected up to and including 2.0.4. The advisory says 2.0.5 fixes it, and that a patch was also provided for 2.0.3.
The record names three methods: IdxrmanufacturerFunctions::getCornersLink, getManufacturersLike and getSuppliersLike. The advisory says the fix sanitises the search parameter with pSQL. The weakness is CWE-89.
The NVD record scores it 9.8 (Critical) with the vector CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H. The weakness class is CWE-89 (SQL injection). The record does not list this CVE in the CISA Known Exploited Vulnerabilities catalog, and nothing we read says it is exploited in the wild.
How to check if you're exposed
In the PrestaShop back office, open Module Manager and read the version of the module. You can also check the module folder in your installation under modules/idxrmanufacturer for its configuration file, which holds the version string.
The advisory notes that standard frontend logs may only show POST requests to the root path. It recommends enabling ModSecurity audit logging to detect exploitation. If you were exposed, assume customer and admin data could have been read and review your database accordingly.
What to do now
- Upgrade idxrmanufacturer to 2.0.5 or later, or apply the provided patch if you must stay on 2.0.3.
- If you do not use the alphabetical search, disable and delete the module.
- Upgrade PrestaShop itself. The advisory notes this blocks multi-query execution but not UNION based data theft.
- Consider OWASP CRS 942 rules on a web application firewall, and expect to tune them for the back office.
- Review admin accounts and database logs for unexpected activity.
Why it matters
SQL injection happens when request data is placed into a database query without being escaped or parameterised. Here a guest controlled search value reaches the query, so no account is needed. Online shops hold customer details, orders and admin credential hashes, which makes the data valuable.
The advisory also points out that changing the default database prefix gives little protection against a determined attacker. The durable fix is to run patched module code and, where possible, remove modules you do not use.
Try it yourself
Third party modules are easy to forget. This demo shows how a vulnerability inventory keeps track of what is installed and what needs patching.
Click through it at your own pace, or open it full screen.
Quick check
What version fixes it?
2.0.5. A patch is also provided for 2.0.3.
Does the attacker need to log in?
No. The advisory says a guest can trigger it.
Sources
Last reviewed: 19 October 2026.
