CVE-2023-46351 is a critical severity (CVSS 9.8) SQL injection in the mib (Manufacturers and Brands Images Block) module from MyPresta.eu for PrestaShop. Versions before 1.6.1 are affected. Upgrade to 1.6.1. The advisory says it is only exploitable when the categories filter is enabled, which is not the default.
What's affected
The record says mib below 1.6.1 is affected. The Friends of Presta advisory lists the impacted release as 1.6.0 and below, with 1.6.1 fixing it. The vulnerable method is mib::getManufacturersByCategory().
The advisory adds an important condition: the flaw is only exploitable when the "Activate categories filter" setting is on. It is off by default. The fix converts the category value to an integer in the affected query. The weakness is CWE-89.
The NVD record scores it 9.8 (Critical) with the vector CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H. The weakness class is CWE-89 (SQL injection). The record does not list this CVE in the CISA Known Exploited Vulnerabilities catalog, and nothing we read says it is exploited in the wild.
How to check if you're exposed
In the PrestaShop back office, open Module Manager and read the mib version. Then open the module configuration and check whether the categories filter is enabled. If it is on and the version is below 1.6.1, you are exposed.
The advisory says standard frontend logs may show only POST requests to the root, so enable ModSecurity AuditEngine or similar logging if you want to detect exploitation.
What to do now
- Upgrade mib to 1.6.1 or later.
- If you cannot upgrade at once, turn off the categories filter.
- Upgrade PrestaShop itself, which disables multi-query execution but does not stop UNION based theft.
- Consider a web application firewall with OWASP CRS 942 rules, and plan for tuning.
- Review administrator accounts and database activity for signs of misuse.
Why it matters
SQL injection puts request data directly into a query. The mib module took a category value and used it in a query without forcing it to be a number, so a guest could shape the query. Shops store customer records and order data, and the account that PrestaShop uses to reach the database is rarely limited.
The condition that the filter must be enabled is useful to know, but it is not a reason to delay. Configurations change, and a setting that is off today can be switched on tomorrow.
Quick check
Am I safe if the categories filter is off?
The advisory says the flaw is only exploitable with the filter enabled, but upgrading to 1.6.1 is still the right fix.
Does it need a login?
No. The advisory says a guest can exploit it.
Sources
Last reviewed: 19 October 2026.
