CVE-2023-43985 is a critical (CVSS 9.8) SQL injection in the StBlogSearchClass::prepareSearch method of SunnyToo's stblogsearch module for PrestaShop. No login is needed. The module's author fixed it in Panda Theme 2.8 and Transform Theme 4.7.0, so update the module or your whole theme.
What's affected
The record lists SunnyToo stblogsearch up to version 1.0.0 for PrestaShop. The Friends of Presta advisory says the module is affected up to version 1.0 and notes that the author does not use semantic versioning for these modules. It therefore advises updating the whole theme, and names Panda Theme 2.8 and Transform Theme 4.7.0 as the fixed releases.
Severity agrees across sources. The record scores 9.8 (Critical), vector CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H, and the advisory also rates it critical at 9.8. The weakness is CWE-89, SQL injection. The advisory describes a guest attacker with no privileges and no user interaction, and says the issue came from a code review by TouchWeb.fr in August 2023 and was disclosed in January 2024. It does not report active exploitation, and the record's KEV flag is false.
How to check if you're exposed
- In your PrestaShop back office, open Modules and look for the module named Blog Search (stblogsearch) or a SunnyToo theme such as Panda or Transform.
- Check the theme version. Panda should be 2.8 or later and Transform 4.7.0 or later.
- On the server, search the modules folder for the module directory, for example with
ls modules | grep stblogsearch. - Check web logs for odd search requests. The advisory warns that frontend logs may show only a bare POST to the site root, so enable fuller request logging such as ModSecurity audit logging if you can.
Safeguard offers a free in-browser dependency scan at gold.safeguard.sh/scan. It reads package manifests, so it will not see installed desktop software or device firmware, but it covers the open source dependencies in your own code.
What to do now
- Update the theme to Panda 2.8 or Transform 4.7.0 or later, or update the module as the author directs.
- If you cannot update at once, disable the Blog Search module.
- Keep PrestaShop current. The advisory notes newer versions disable multiquery execution, which limits damage but does not stop data theft through UNION queries.
- Consider a web application firewall with the OWASP 942 rules. The advisory warns it can break the back office and need exceptions.
- Review your database and admin accounts for unexpected changes, and rotate secrets if you suspect abuse.
Why it matters
SQL injection occurs when user input is placed into a database query without being escaped, so the input can change the meaning of the query. In this module, the search terms go straight into SQL. The author's fix wraps each term in PrestaShop's pSQL() escaping function.
Online shops hold customer records and order data, so a flaw reachable by any visitor is serious. The search box is public, which is why the score is 9.8. Themes and modules bought from marketplaces are not always tracked in the same way as core software, so they are easy to miss during patching.
Try it yourself
Click through it at your own pace, or open it full screen.
Quick check
Do I need to be logged in to exploit it?
No. The record and advisory describe a guest, unauthenticated attacker.
Which version fixes it?
Panda Theme 2.8 or Transform Theme 4.7.0, as the advisory states. The module itself is not versioned in a way that helps.
Sources
Last reviewed: 19 October 2026.
