CVE-2023-46914 is a critical severity (CVSS 9.8) SQL injection in the RM bookingcalendar module for PrestaShop, in ics_export.php, versions 2.7.9 and earlier. The author has stopped supporting the module and released no fix. Delete the module, or apply the advisory patches as an unofficial stopgap.
What's affected
The record and the Friends of Presta advisory say bookingcalendar 2.7.9 and earlier is affected. The advisory also gives patches for the 2.5.6 line. It says the author has stopped supporting the module and shows no fix. The patches in the advisory are code changes, not official releases.
Severity differs by condition. NVD scores it 9.8 Critical. The advisory notes that for most installations, where the module is installed and its secret is set, the score drops to 7.2. We report both. The weakness is CWE-89.
The NVD record scores it 9.8 (Critical) with the vector CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H. The weakness class is CWE-89 (SQL injection). The record does not list this CVE in the CISA Known Exploited Vulnerabilities catalog, and nothing we read says it is exploited in the wild.
How to check if you're exposed
In the PrestaShop back office, open Module Manager and look for the booking calendar module. Check its version, and confirm whether it is still enabled. You can also check the modules folder on disk for bookingcalendar, since a disabled module may still have reachable files.
The advisory recommends logging that captures request detail, because standard logs can hide the attack.
What to do now
- Delete the bookingcalendar module, which is the advisory's main recommendation, and remove its folder from disk.
- If you need the feature, move to a maintained booking module.
- If removal is not possible, apply the advisory patches and treat them as unofficial.
- Upgrade PrestaShop, and consider OWASP CRS 942 rules, with tuning for the back office.
- Review admin accounts and the database for signs of misuse.
Why it matters
SQL injection in an export script means request data reaches a database query without proper handling. Because the module is abandoned, no vendor will correct it, and each store that keeps it relies on its own patch.
The lesson for shop owners is about third party modules. Each one adds code you have to track. Abandoned modules should be removed rather than carried, since a flaw like this never gets an official fix.
Quick check
Is there an official fix?
No. The author stopped supporting the module. Only unofficial patches exist.
Why is the score 9.8 in NVD but 7.2 in the advisory?
The advisory says most installs have a secret set, which lowers the real score to 7.2.
Sources
Last reviewed: 19 October 2026.
