CVE-2023-46953 is a critical SQL injection in ABO.CMS 5.9.3, scored 9.8, in the d parameter of the Documents module. I found no vendor advisory or fixed version, so contact the vendor, limit public access to the module, and apply database and web firewall controls until a patch is confirmed.
What's affected
The record names ABO.CMS 5.9.3 and says the d parameter in the Documents module is open to SQL injection from remote attackers. The only reference is a public write-up on CXSecurity, dated 20 December 2023.
The sources disagree in a few ways. The researcher states the version tested was 5.9.3 but says all editions of ABO.CMS are affected. The record names only 5.9.3. The write-up rates the risk as Medium, with the author's own note of high to critical, while NVD scores it 9.8 Critical. The record also says the flaw allows executing arbitrary code, but the write-up describes boolean based SQL injection, which reads data. Plan for the worst case, and look at your own deployment.
I found no fixed version. Do not assume a later release resolves it until the vendor says so.
The NVD record was published on 2024-01-06, scores 9.8 (Critical), and carries the vector CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H. Weakness class: CWE-89.
How to check if you're exposed
You will need to check this by version and by exposure, since there is no published fix to compare against.
- Read the version in your ABO.CMS admin area or release files, and note whether you run 5.9.3 or another edition.
- Check whether the Documents module is reachable from the internet, and review web server logs for unusual or very long values in the d parameter.
- Ask the vendor in writing whether your edition is affected and which build contains a fix.
Do not test your production site with injection strings. A staging copy and a scanner you control are the safe route.
What to do now
- Confirm whether you run ABO.CMS and which edition and build.
- Contact the vendor for a fixed version or written mitigation, and record the reply.
- Put the Documents module behind authentication or an IP allow list if the business can accept it.
- Use a web application firewall rule for SQL syntax in that parameter as a short term control, not a fix.
- Make sure the database account the CMS uses has only the permissions it needs.
Why it matters
SQL injection is CWE-89. User input ends up inside a database query, so input changes the meaning of the query. The standard fix is parameterized queries, which keep data and commands separate.
In the write-up, a single quote in the date value breaks the query and returns a server error, which signals that input reaches the query unescaped. That is the level of detail needed here. The impact depends on database permissions and on which tables hold user data. The record's KEV flag is false, so this CVE is not on the CISA Known Exploited Vulnerabilities list.
With no documented fix, the risk is a long tail of unpatched sites. Controls around the application become the main defense.
Quick check
Is there a patch?
I did not find one. The record and the public write-up do not give a fixed version, so ask the vendor.
Sources
Last reviewed: 19 October 2026.
