CVE-2025-67650 - Vulnerability Details

An authenticated SQL injection vulnerability has been identified in multiple PHP Jabbers scripts. Improper neutralization of input provided by an authenticated user into parameters responsible for sorting functions allows an attacker to perform SQL Injection attacks.
This issue was fixed in the versions specified in the affected products list.

Attack Vector Network

Attack Complexity Low

Privileges Required High

Attack Requirements None

User Interaction None

Vulnerable System Confidentiality Impact High

Vulnerable System Integrity Impact High

Vulnerable System Availability Impact Low

Subsequent System Confidentiality Impact None

Subsequent System Integrity Impact None

Subsequent System Availability Impact None

No CVSS v3.1

No CVSS v3.0

No CVSS v2

This CVE is not in the KEV list.

No EPSS score available.

Key SSVC decision points have not yet been added.

Default status is the baseline for the product, each version can override it (e.g. patched versions marked unaffected).

Vendor Product Default status Versions

PHP Jabbers

Appointment Scheduler

unaffected

Version	Status	Constraints
`0`	affected	< 4.1

PHP Jabbers

Bus Reservation System

unaffected

Version	Status	Constraints
`0`	affected	< 2.1

PHP Jabbers

Car Park Booking System

unaffected

Version	Status	Constraints
`0`	affected	< 4.1

PHP Jabbers

Car Rental Script

unaffected

Version	Status	Constraints
`0`	affected	< 4.1

PHP Jabbers

Cinema Booking System

unaffected

Version	Status	Constraints
`0`	affected	< 2.1

PHP Jabbers

Event Booking Calendar

unaffected

Version	Status	Constraints
`0`	affected	< 5.1

PHP Jabbers

Event Ticketing System

unaffected

Version	Status	Constraints
`0`	affected	< 2.1

PHP Jabbers

Hotel Booking System

unaffected

Version	Status	Constraints
`0`	affected	< 5.1

PHP Jabbers

Cleaning Business Software

unaffected

Version	Status	Constraints
`0`	affected	< 2.1

PHP Jabbers

Equipment Rental Script

unaffected

Version	Status	Constraints
`0`	affected	< 2.1

PHP Jabbers

Food Delivery Script

unaffected

Version	Status	Constraints
`0`	affected	< 4.1

PHP Jabbers

Member Login Script

unaffected

Version	Status	Constraints
`0`	affected	< 4.1

PHP Jabbers

Member Directory Script

unaffected

Version	Status	Constraints
`0`	affected	< 2.1

PHP Jabbers

Availability Calendar

unaffected

Version	Status	Constraints
`0`	affected	< 6.1

PHP Jabbers

PHP Event Calendar

unaffected

Version	Status	Constraints
`0`	affected	< 4.1

PHP Jabbers

PHP Newsletter Script

unaffected

Version	Status	Constraints
`0`	affected	< 5.1

PHP Jabbers

Product Comparison Script

unaffected

Version	Status	Constraints
`0`	affected	< 2.1

PHP Jabbers

Ticket Support Script

unaffected

Version	Status	Constraints
`0`	affected	< 4.1

PHP Jabbers

PHP Shopping Cart

unaffected

Version	Status	Constraints
`0`	affected	< 6.0

PHP Jabbers

Auto Classifieds Script

unaffected

Version	Status	Constraints
`0`	affected	< 4.1

PHP Jabbers

Business Directory Script

unaffected

Version	Status	Constraints
`0`	affected	< 4.1

PHP Jabbers

Availability Booking Calendar

unaffected

Version	Status	Constraints
`0`	affected	< 6.1

PHP Jabbers

Time Slots Booking Calendar

unaffected

Version	Status	Constraints
`0`	affected	< 5.1

PHP Jabbers

Restaurant Booking System

unaffected

Version	Status	Constraints
`0`	affected	< 4.1

PHP Jabbers

Shuttle Booking Software

unaffected

Version	Status	Constraints
`0`	affected	< 3.1

PHP Jabbers

Meeting Room Booking System

unaffected

Version	Status	Constraints
`0`	affected	< 2.1

PHP Jabbers

Rental Property Booking Calendar

unaffected

Version	Status	Constraints
`0`	affected	< 3.1

PHP Jabbers

Service Booking Script

unaffected

Version	Status	Constraints
`0`	affected	< 2.1

PHP Jabbers

Limo Booking Software

unaffected

Version	Status	Constraints
`0`	affected	< 2.1

PHP Jabbers

Taxi Booking Script

unaffected

Version	Status	Constraints
`0`	affected	< 3.1

PHP Jabbers

Job Listing Script

unaffected

Version	Status	Constraints
`0`	affected	< 4.1

PHP Jabbers

Property Listing Script

unaffected

Version	Status	Constraints
`0`	affected	< 4.1

PHP Jabbers

Travel Tours Script

unaffected

Version	Status	Constraints
`0`	affected	< 3.1

PHP Jabbers

Vacation Rental Script

unaffected

Version	Status	Constraints
`0`	affected	< 5.1

PHP Jabbers

Yacht Listing Script

unaffected

Version	Status	Constraints
`0`	affected	< 3.1

No data.

Project Subscriptions

Vendors	Products
Php Jabbers Subscribe	Appointment Scheduler Subscribe Auto Classifieds Script Subscribe Availability Booking Calendar Subscribe Availability Calendar Subscribe Bus Reservation System Subscribe Business Directory Script Subscribe Car Park Booking System Subscribe Car Rental Script Subscribe Cinema Booking System Subscribe Cleaning Business Software Subscribe Equipment Rental Script Subscribe Event Booking Calendar Subscribe Event Ticketing System Subscribe Food Delivery Script Subscribe Hotel Booking System Subscribe Job Listing Script Subscribe Limo Booking Software Subscribe Meeting Room Booking System Subscribe Member Directory Script Subscribe Member Login Script Subscribe Php Event Calendar Subscribe Php Newsletter Script Subscribe Php Shopping Cart Subscribe Product Comparison Script Subscribe Property Listing Script Subscribe Rental Property Booking Calendar Subscribe Restaurant Booking System Subscribe Service Booking Script Subscribe Shuttle Booking Software Subscribe Taxi Booking Script Subscribe Ticket Support Script Subscribe Time Slots Booking Calendar Subscribe Travel Tours Script Subscribe Vacation Rental Script Subscribe Yacht Listing Script Subscribe

Advisories

No advisories yet.

Fixes

Solution

No solution given by the vendor.

Workaround

No workaround given by the vendor.

References

Link	Providers
https://cert.pl/en/posts/2026/07/CVE-2025-67649/
https://www.phpjabbers.com/

History

Fri, 31 Jul 2026 12:00:00 +0000

Type	Values Removed	Values Added
Description		An authenticated SQL injection vulnerability has been identified in multiple PHP Jabbers scripts. Improper neutralization of input provided by an authenticated user into parameters responsible for sorting functions allows an attacker to perform SQL Injection attacks. This issue was fixed in the versions specified in the affected products list.
Title		Authenticated SQL Injection in PHP Jabbers scripts
First Time appeared		Php Jabbers Php Jabbers appointment Scheduler Php Jabbers auto Classifieds Script Php Jabbers availability Booking Calendar Php Jabbers availability Calendar Php Jabbers bus Reservation System Php Jabbers business Directory Script Php Jabbers car Park Booking System Php Jabbers car Rental Script Php Jabbers cinema Booking System Php Jabbers cleaning Business Software Php Jabbers equipment Rental Script Php Jabbers event Booking Calendar Php Jabbers event Ticketing System Php Jabbers food Delivery Script Php Jabbers hotel Booking System Php Jabbers job Listing Script Php Jabbers limo Booking Software Php Jabbers meeting Room Booking System Php Jabbers member Directory Script Php Jabbers member Login Script Php Jabbers php Event Calendar Php Jabbers php Newsletter Script Php Jabbers php Shopping Cart Php Jabbers product Comparison Script Php Jabbers property Listing Script Php Jabbers rental Property Booking Calendar Php Jabbers restaurant Booking System Php Jabbers service Booking Script Php Jabbers shuttle Booking Software Php Jabbers taxi Booking Script Php Jabbers ticket Support Script Php Jabbers time Slots Booking Calendar Php Jabbers travel Tours Script Php Jabbers vacation Rental Script Php Jabbers yacht Listing Script
Weaknesses		CWE-89
CPEs		cpe:2.3:a:php_jabbers:appointment_scheduler:::::::: cpe:2.3:a:php_jabbers:auto_classifieds_script:::::::: cpe:2.3:a:php_jabbers:availability_booking_calendar:::::::: cpe:2.3:a:php_jabbers:availability_calendar:::::::: cpe:2.3:a:php_jabbers:bus_reservation_system:::::::: cpe:2.3:a:php_jabbers:business_directory_script:::::::: cpe:2.3:a:php_jabbers:car_park_booking_system:::::::: cpe:2.3:a:php_jabbers:car_rental_script:::::::: cpe:2.3:a:php_jabbers:cinema_booking_system:::::::: cpe:2.3:a:php_jabbers:cleaning_business_software:::::::: cpe:2.3:a:php_jabbers:equipment_rental_script:::::::: cpe:2.3:a:php_jabbers:event_booking_calendar:::::::: cpe:2.3:a:php_jabbers:event_ticketing_system:::::::: cpe:2.3:a:php_jabbers:food_delivery_script:::::::: cpe:2.3:a:php_jabbers:hotel_booking_system:::::::: cpe:2.3:a:php_jabbers:job_listing_script:::::::: cpe:2.3:a:php_jabbers:limo_booking_software:::::::: cpe:2.3:a:php_jabbers:meeting_room_booking_system:::::::: cpe:2.3:a:php_jabbers:member_directory_script:::::::: cpe:2.3:a:php_jabbers:member_login_script:::::::: cpe:2.3:a:php_jabbers:php_event_calendar:::::::: cpe:2.3:a:php_jabbers:php_newsletter_script:::::::: cpe:2.3:a:php_jabbers:php_shopping_cart:::::::: cpe:2.3:a:php_jabbers:product_comparison_script:::::::: cpe:2.3:a:php_jabbers:property_listing_script:::::::: cpe:2.3:a:php_jabbers:rental_property_booking_calendar:::::::: cpe:2.3:a:php_jabbers:restaurant_booking_system:::::::: cpe:2.3:a:php_jabbers:service_booking_script:::::::: cpe:2.3:a:php_jabbers:shuttle_booking_software:::::::: cpe:2.3:a:php_jabbers:taxi_booking_script:::::::: cpe:2.3:a:php_jabbers:ticket_support_script:::::::: cpe:2.3:a:php_jabbers:time_slots_booking_calendar:::::::: cpe:2.3:a:php_jabbers:travel_tours_script:::::::: cpe:2.3:a:php_jabbers:vacation_rental_script:::::::: cpe:2.3:a:php_jabbers:yacht_listing_script::::::::
Vendors & Products		Php Jabbers Php Jabbers appointment Scheduler Php Jabbers auto Classifieds Script Php Jabbers availability Booking Calendar Php Jabbers availability Calendar Php Jabbers bus Reservation System Php Jabbers business Directory Script Php Jabbers car Park Booking System Php Jabbers car Rental Script Php Jabbers cinema Booking System Php Jabbers cleaning Business Software Php Jabbers equipment Rental Script Php Jabbers event Booking Calendar Php Jabbers event Ticketing System Php Jabbers food Delivery Script Php Jabbers hotel Booking System Php Jabbers job Listing Script Php Jabbers limo Booking Software Php Jabbers meeting Room Booking System Php Jabbers member Directory Script Php Jabbers member Login Script Php Jabbers php Event Calendar Php Jabbers php Newsletter Script Php Jabbers php Shopping Cart Php Jabbers product Comparison Script Php Jabbers property Listing Script Php Jabbers rental Property Booking Calendar Php Jabbers restaurant Booking System Php Jabbers service Booking Script Php Jabbers shuttle Booking Software Php Jabbers taxi Booking Script Php Jabbers ticket Support Script Php Jabbers time Slots Booking Calendar Php Jabbers travel Tours Script Php Jabbers vacation Rental Script Php Jabbers yacht Listing Script
References		https://cert.pl/en/posts/2026/07/CVE-2025-67649/ https://www.phpjabbers.com/
Metrics		cvssV4_0 `{'score': 8.6, 'vector': 'CVSS:4.0/AV:N/AC:L/AT:N/PR:H/UI:N/VC:H/VI:H/VA:L/SC:N/SI:N/SA:N'}`

Projects

Sign in to view the affected projects.

MITRE

Status: PUBLISHED

Assigner: CERT-PL

Published: 2026-07-31T11:40:40.346Z

Updated: 2026-07-31T11:40:40.346Z

Reserved: 2025-12-09T19:10:43.240Z

Link: CVE-2025-67650

Vulnrichment

No data.

NVD

No data.

Redhat

No data.

OpenCVE Enrichment

No data.

Weaknesses

CWE-89

Attack Vector Network

Attack Complexity Low

Privileges Required High

Attack Requirements None

User Interaction None

Vulnerable System Confidentiality Impact High

Vulnerable System Integrity Impact High

Vulnerable System Availability Impact Low

Subsequent System Confidentiality Impact None

Subsequent System Integrity Impact None

Subsequent System Availability Impact None

Project Subscriptions

Projects

JSON object

JSON object

JSON object

JSON object

JSON object