Full Report
CERT Polska has received a report about 5 vulnerabilities (from CVE-2025-67649 to CVE-2025-67651 and from CVE-2026-46593 to CVE-2026-46594) found in PHP Jabbers scripts.
Analysis Summary
# Vulnerability: Multiple Flaws in PHP Jabbers Scripts
## CVE Details
- **CVE ID:** CVE-2025-67649, CVE-2025-67650, CVE-2025-67651, CVE-2026-46593, CVE-2026-46594
- **CVSS Score:** Not explicitly provided in the source (Typically High for SQLi/CSRF)
- **CWE:**
- CWE-89: Improper Neutralization of Special Elements used in an SQL Command (SQL Injection)
- CWE-352: Cross-Site Request Forgery (CSRF)
- CWE-79: Improper Neutralization of Input During Web Page Generation (XSS)
## Affected Systems
- **Products:** Multiple PHP Jabbers scripts including Car Rental Script, PHP Poll Script, Appointment Scheduler, Bus Reservation System, Hotel Booking System, and 30+ other specialized web scripts.
- **Versions:**
- **Car Rental Script:** All before 4.1
- **PHP Poll Script:** All before 4.1
- **Other Scripts:** Various versions (e.g., Cinema Booking System < 2.1, Availability Calendar < 6.1). See Remediation section for specific fix versions.
- **Configurations:** Web servers running vulnerable versions of PHP Jabbers scripts.
## Vulnerability Description
Five distinct vulnerability classes were identified across the PHP Jabbers product line:
1. **Unauthenticated SQL Injection (CVE-2025-67649):** Improper neutralization of sorting parameters in the Car Rental Script allows remote attackers to execute arbitrary SQL commands without logging in.
2. **Authenticated SQL Injection (CVE-2026-46593 & CVE-2025-67650):** Improper neutralization of input in sorting functions and the `pjAdminPolls.controller.php` endpoint allows logged-in users to perform SQL injection.
3. **Cross-Site Request Forgery (CVE-2025-67651):** Missing CSRF tokens and SameSite attributes allow attackers to trick authenticated admins into performing unauthorized actions, such as creating new administrative accounts.
4. **Reflected XSS (CVE-2026-46594):** Vulnerability in the PHP Poll Script where specially crafted URLs can execute arbitrary JavaScript in a victim's browser.
## Exploitation
- **Status:** PoC status not explicitly mentioned; reported via coordinated vulnerability disclosure.
- **Complexity:** Low to Medium.
- **Attack Vector:** Network (Remote).
## Impact
- **Confidentiality:** High (Data theft via SQL Injection).
- **Integrity:** High (Unauthorized admin account creation via CSRF; database modification via SQLi).
- **Availability:** Medium to High (Potential database disruption).
## Remediation
### Patches
The following minimum versions contain the fixes:
- **v6.1:** Availability Calendar, Availability Booking Calendar.
- **v6.0:** PHP Shopping Cart.
- **v5.1:** Event Booking Calendar, Hotel Booking System, PHP Newsletter Script, Time Slots Booking Calendar, Vacation Rental Script.
- **v4.1:** Car Rental Script, PHP Poll Script, Appointment Scheduler, Car Park Booking System, Food Delivery Script, Member Login Script, PHP Event Calendar, Ticket Support Script, Auto Classifieds Script, Business Directory Script, Restaurant Booking System, Job Listing Script, Property Listing Script.
- **v3.1:** Shuttle Booking Software, Rental Property Booking Calendar, Taxi Booking Script, Travel Tours Script, Yacht Listing Script.
- **v2.1:** Bus Reservation System, Cinema Booking System, Event Ticketing System, Cleaning Business Software, Equipment Rental Script, Member Directory Script, Product Comparison Script, Meeting Room Booking System, Service Booking Script, Limo Booking Software.
### Workarounds
No official workarounds provided; users are strongly urged to update to the latest versions.
## Detection
- Monitor web server logs for unusual SQL syntax in URL parameters (especially those related to sorting).
- Audit administrative accounts for unauthorized new users (Indicator of CSRF exploitation).
- Inspect logs for script tags or unexpected payloads in requests to the PHP Poll Script.
## References
- CERT Polska Advisory: [https://cert.pl/en/posts/2024/07/vulnerabilities-in-php-jabbers-scripts/](https://cert.pl/en/posts/2024/07/vulnerabilities-in-php-jabbers-scripts/)
- CVE Records: [https://www.cve.org/CVERecord?id=CVE-2025-67649](https://www.cve.org/CVERecord?id=CVE-2025-67649)
- CVD Policy: [https://cert.pl/en/cvd](https://cert.pl/en/cvd)