CVE-2025-67650: Authenticated SQL Injection in PHP Jabbers scripts

Severity: high (CVSS 8.6 v4.0)
Exploited in the wild: not listed in CISA KEV
EPSS: 0.4% probability of exploitation in the next 30 days
Public exploit or detection template: none known
Published: 2026-07-31 · updated 2026-09-29
Weakness: CWE-89

Description

An authenticated SQL injection vulnerability has been identified in multiple PHP Jabbers scripts. Improper neutralization of input provided by an authenticated user into parameters responsible for sorting functions allows an attacker to perform SQL Injection attacks. This issue was fixed in the versions specified in the affected products list.

Affected products

PHP Jabbers Appointment Scheduler: before 4.1 — fixed in 4.1
PHP Jabbers Auto Classifieds Script: before 4.1 — fixed in 4.1
PHP Jabbers Availability Booking Calendar: before 6.1 — fixed in 6.1
PHP Jabbers Availability Calendar: before 6.1 — fixed in 6.1
PHP Jabbers Bus Reservation System: before 2.1 — fixed in 2.1
PHP Jabbers Business Directory Script: before 4.1 — fixed in 4.1
PHP Jabbers Car Park Booking System: before 4.1 — fixed in 4.1
PHP Jabbers Car Rental Script: before 4.1 — fixed in 4.1
PHP Jabbers Cinema Booking System: before 2.1 — fixed in 2.1
PHP Jabbers Cleaning Business Software: before 2.1 — fixed in 2.1
PHP Jabbers Equipment Rental Script: before 2.1 — fixed in 2.1
PHP Jabbers Event Booking Calendar: before 5.1 — fixed in 5.1
PHP Jabbers Event Ticketing System: before 2.1 — fixed in 2.1
PHP Jabbers Food Delivery Script: before 4.1 — fixed in 4.1
PHP Jabbers Hotel Booking System: before 5.1 — fixed in 5.1
PHP Jabbers Job Listing Script: before 4.1 — fixed in 4.1
PHP Jabbers Limo Booking Software: before 2.1 — fixed in 2.1
PHP Jabbers Meeting Room Booking System: before 2.1 — fixed in 2.1
PHP Jabbers Member Directory Script: before 2.1 — fixed in 2.1
PHP Jabbers Member Login Script: before 4.1 — fixed in 4.1
PHP Jabbers PHP Event Calendar: before 4.1 — fixed in 4.1
PHP Jabbers PHP Newsletter Script: before 5.1 — fixed in 5.1
PHP Jabbers PHP Shopping Cart: before 6.0 — fixed in 6.0
PHP Jabbers Product Comparison Script: before 2.1 — fixed in 2.1
PHP Jabbers Property Listing Script: before 4.1 — fixed in 4.1
PHP Jabbers Rental Property Booking Calendar: before 3.1 — fixed in 3.1
PHP Jabbers Restaurant Booking System: before 4.1 — fixed in 4.1
PHP Jabbers Service Booking Script: before 2.1 — fixed in 2.1
PHP Jabbers Shuttle Booking Software: before 3.1 — fixed in 3.1
PHP Jabbers Taxi Booking Script: before 3.1 — fixed in 3.1

How to fix

Upgrade to a fixed version: PHP Jabbers Appointment Scheduler 4.1; PHP Jabbers Auto Classifieds Script 4.1; PHP Jabbers Availability Booking Calendar 6.1; PHP Jabbers Availability Calendar 6.1; PHP Jabbers Bus Reservation System 2.1; PHP Jabbers Business Directory Script 4.1; PHP Jabbers Car Park Booking System 4.1; PHP Jabbers Car Rental Script 4.1; PHP Jabbers Cinema Booking System 2.1; PHP Jabbers Cleaning Business Software 2.1; PHP Jabbers Equipment Rental Script 2.1; PHP Jabbers Event Booking Calendar 5.1. Check the vendor advisory for mitigations.

References

Get alerted when CVE-2025-67650 or the next vulnerability affects your stack