Authenticated SQL Injection in PHP Jabbers scripts
Summary
| CVE | CVE-2025-67650 |
|---|---|
| State | PUBLISHED |
| Assigner | CERT-PL |
| Source Priority | CVE Program / NVD first with legacy fallback |
| Published | 2026-07-31 12:16:48 UTC |
| Updated | 2026-08-28 15:26:19 UTC |
| Description | An authenticated SQL injection vulnerability has been identified in multiple PHP Jabbers scripts. Improper neutralization of input provided by an authenticated user into parameters responsible for sorting functions allows an attacker to perform SQL Injection attacks. This issue was fixed in the versions specified in the affected products list. |
Risk And Classification
Primary CVSS: v4.0 8.6 HIGH from [email protected]
CVSS:4.0/AV:N/AC:L/AT:N/PR:H/UI:N/VC:H/VI:H/VA:L/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X
EPSS: 0.002790000 probability, percentile 0.199810000 (date 2026-08-30)
Problem Types: CWE-89 | CWE-89 CWE-89 Improper neutralization of special elements used in an SQL command ('SQL injection')
| Version | Source | Type | Score | Severity | Vector |
|---|---|---|---|---|---|
| 4.0 | [email protected] | Secondary | 8.6 | HIGH | CVSS:4.0/AV:N/AC:L/AT:N/PR:H/UI:N/VC:H/VI:H/VA:L/SC:N/SI:N/SA:N/E:X/C... |
| 4.0 | CNA | CVSS | 8.6 | HIGH | CVSS:4.0/AV:N/AC:L/AT:N/PR:H/UI:N/VC:H/VI:H/VA:L/SC:N/SI:N/SA:N |
CVSS v4.0 Breakdown
Attack Vector
NetworkAttack Complexity
LowAttack Requirements
NonePrivileges Required
HighUser Interaction
NoneConfidentiality
HighIntegrity
HighAvailability
LowSub Conf.
NoneSub Integrity
NoneSub Availability
NoneCVSS:4.0/AV:N/AC:L/AT:N/PR:H/UI:N/VC:H/VI:H/VA:L/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X
Vendor Declared Affected Products
| Source | Vendor | Product | Version | Platforms |
|---|---|---|---|---|
| CNA | PHP Jabbers | Appointment Scheduler | affected 4.1 custom | Not specified |
| CNA | PHP Jabbers | Bus Reservation System | affected 2.1 custom | Not specified |
| CNA | PHP Jabbers | Car Park Booking System | affected 4.1 custom | Not specified |
| CNA | PHP Jabbers | Car Rental Script | affected 4.1 custom | Not specified |
| CNA | PHP Jabbers | Cinema Booking System | affected 2.1 custom | Not specified |
| CNA | PHP Jabbers | Event Booking Calendar | affected 5.1 custom | Not specified |
| CNA | PHP Jabbers | Event Ticketing System | affected 2.1 custom | Not specified |
| CNA | PHP Jabbers | Hotel Booking System | affected 5.1 custom | Not specified |
| CNA | PHP Jabbers | Cleaning Business Software | affected 2.1 custom | Not specified |
| CNA | PHP Jabbers | Equipment Rental Script | affected 2.1 custom | Not specified |
| CNA | PHP Jabbers | Food Delivery Script | affected 4.1 custom | Not specified |
| CNA | PHP Jabbers | Member Login Script | affected 4.1 custom | Not specified |
| CNA | PHP Jabbers | Member Directory Script | affected 2.1 custom | Not specified |
| CNA | PHP Jabbers | Availability Calendar | affected 6.1 custom | Not specified |
| CNA | PHP Jabbers | PHP Event Calendar | affected 4.1 custom | Not specified |
| CNA | PHP Jabbers | PHP Newsletter Script | affected 5.1 custom | Not specified |
| CNA | PHP Jabbers | Product Comparison Script | affected 2.1 custom | Not specified |
| CNA | PHP Jabbers | Ticket Support Script | affected 4.1 custom | Not specified |
| CNA | PHP Jabbers | PHP Shopping Cart | affected 6.0 custom | Not specified |
| CNA | PHP Jabbers | Auto Classifieds Script | affected 4.1 custom | Not specified |
| CNA | PHP Jabbers | Business Directory Script | affected 4.1 custom | Not specified |
| CNA | PHP Jabbers | Availability Booking Calendar | affected 6.1 custom | Not specified |
| CNA | PHP Jabbers | Time Slots Booking Calendar | affected 5.1 custom | Not specified |
| CNA | PHP Jabbers | Restaurant Booking System | affected 4.1 custom | Not specified |
| CNA | PHP Jabbers | Shuttle Booking Software | affected 3.1 custom | Not specified |
| CNA | PHP Jabbers | Meeting Room Booking System | affected 2.1 custom | Not specified |
| CNA | PHP Jabbers | Rental Property Booking Calendar | affected 3.1 custom | Not specified |
| CNA | PHP Jabbers | Service Booking Script | affected 2.1 custom | Not specified |
| CNA | PHP Jabbers | Limo Booking Software | affected 2.1 custom | Not specified |
| CNA | PHP Jabbers | Taxi Booking Script | affected 3.1 custom | Not specified |
| CNA | PHP Jabbers | Job Listing Script | affected 4.1 custom | Not specified |
| CNA | PHP Jabbers | Property Listing Script | affected 4.1 custom | Not specified |
| CNA | PHP Jabbers | Travel Tours Script | affected 3.1 custom | Not specified |
| CNA | PHP Jabbers | Vacation Rental Script | affected 5.1 custom | Not specified |
| CNA | PHP Jabbers | Yacht Listing Script | affected 3.1 custom | Not specified |
References
| Reference | Source | Link | Tags |
|---|---|---|---|
| www.phpjabbers.com | [email protected] | www.phpjabbers.com | |
| cert.pl/en/posts/2026/07/CVE-2025-67649 | [email protected] | cert.pl | |
| CVE Program record | CVE.ORG | www.cve.org | canonical |
| NVD vulnerability detail | NVD | nvd.nist.gov | canonical, analysis |
Vendor Comments And Credit
Discovery Credit
CNA: Kamil Szczurowski (en)
CNA: Robert Kruczek (en)
There are currently no legacy QID mappings associated with this CVE.