Read the docs
TI-2025-41393 Aliases CVE-2025-67650GHSA-h3q5-7qh5-pg2p

Authenticated SQL Injection in PHP Jabbers scripts

Priority LOW 39CWE-89Published · Updated

Key facts

Attack vector
Network
Privileges required
High
User interaction
None
Attack complexity
Low
Attack requirements
None
Impact type
SQL injection
Confidentiality · integrity · availability
High · High · Low
Fix status
Fixed

Attack profile from CVSS 4.0 · CNA. Fix status from CNA. Impact type from CWE-89.

Summary

An authenticated SQL injection vulnerability has been identified in multiple PHP Jabbers scripts. Improper neutralization of input provided by an authenticated user into parameters responsible for sorting functions allows an attacker to perform SQL Injection attacks. This issue was fixed in the versions specified in the affected products list.

Why it matters now

Exploitation None reported CISA SSVC · not in CISA KEV
EPSS 0.00383 32nd percentileScored 2026-11-07
Fix Fixed Appointment Scheduler (PHP Jabbers): 4.1Bus Reservation System (PHP Jabbers): 2.1+33 more products

SSVC decision points

CISA ADP · SSVC 2.0.3

Exploitation
None
Automatable
No
Technical impact
Total

The decision (Track, Attend, Act) also depends on your mission and well-being impact; see CISA's SSVC guide.

Affected products

VendorProductAffected versionsFixed inStatusSource
PHP JabbersAppointment Schedulerbefore 4.14.1Patch availableCNA
PHP JabbersBus Reservation Systembefore 2.12.1Patch availableCNA
PHP JabbersCar Park Booking Systembefore 4.14.1Patch availableCNA
PHP JabbersCar Rental Scriptbefore 4.14.1Patch availableCNA
PHP JabbersCinema Booking Systembefore 2.12.1Patch availableCNA
PHP JabbersEvent Booking Calendarbefore 5.15.1Patch availableCNA
PHP JabbersEvent Ticketing Systembefore 2.12.1Patch availableCNA
PHP JabbersHotel Booking Systembefore 5.15.1Patch availableCNA
PHP JabbersCleaning Business Softwarebefore 2.12.1Patch availableCNA
PHP JabbersEquipment Rental Scriptbefore 2.12.1Patch availableCNA
PHP JabbersFood Delivery Scriptbefore 4.14.1Patch availableCNA
PHP JabbersMember Login Scriptbefore 4.14.1Patch availableCNA
PHP JabbersMember Directory Scriptbefore 2.12.1Patch availableCNA
PHP JabbersAvailability Calendarbefore 6.16.1Patch availableCNA
PHP JabbersPHP Event Calendarbefore 4.14.1Patch availableCNA
PHP JabbersPHP Newsletter Scriptbefore 5.15.1Patch availableCNA
PHP JabbersProduct Comparison Scriptbefore 2.12.1Patch availableCNA
PHP JabbersTicket Support Scriptbefore 4.14.1Patch availableCNA
PHP JabbersPHP Shopping Cartbefore 6.06.0Patch availableCNA
PHP JabbersAuto Classifieds Scriptbefore 4.14.1Patch availableCNA
PHP JabbersBusiness Directory Scriptbefore 4.14.1Patch availableCNA
PHP JabbersAvailability Booking Calendarbefore 6.16.1Patch availableCNA
PHP JabbersTime Slots Booking Calendarbefore 5.15.1Patch availableCNA
PHP JabbersRestaurant Booking Systembefore 4.14.1Patch availableCNA
PHP JabbersShuttle Booking Softwarebefore 3.13.1Patch availableCNA
PHP JabbersMeeting Room Booking Systembefore 2.12.1Patch availableCNA
PHP JabbersRental Property Booking Calendarbefore 3.13.1Patch availableCNA
PHP JabbersService Booking Scriptbefore 2.12.1Patch availableCNA
PHP JabbersLimo Booking Softwarebefore 2.12.1Patch availableCNA
PHP JabbersTaxi Booking Scriptbefore 3.13.1Patch availableCNA
PHP JabbersJob Listing Scriptbefore 4.14.1Patch availableCNA
PHP JabbersProperty Listing Scriptbefore 4.14.1Patch availableCNA
PHP JabbersTravel Tours Scriptbefore 3.13.1Patch availableCNA
PHP JabbersVacation Rental Scriptbefore 5.15.1Patch availableCNA
PHP JabbersYacht Listing Scriptbefore 3.13.1Patch availableCNA
  • Appointment Scheduler VendorPHP Jabbers Affected before 4.1 Fixed in 4.1 Patch available CNA
  • Bus Reservation System VendorPHP Jabbers Affected before 2.1 Fixed in 2.1 Patch available CNA
  • Car Park Booking System VendorPHP Jabbers Affected before 4.1 Fixed in 4.1 Patch available CNA
  • Car Rental Script VendorPHP Jabbers Affected before 4.1 Fixed in 4.1 Patch available CNA
  • Cinema Booking System VendorPHP Jabbers Affected before 2.1 Fixed in 2.1 Patch available CNA
  • Event Booking Calendar VendorPHP Jabbers Affected before 5.1 Fixed in 5.1 Patch available CNA
  • Event Ticketing System VendorPHP Jabbers Affected before 2.1 Fixed in 2.1 Patch available CNA
  • Hotel Booking System VendorPHP Jabbers Affected before 5.1 Fixed in 5.1 Patch available CNA
  • Cleaning Business Software VendorPHP Jabbers Affected before 2.1 Fixed in 2.1 Patch available CNA
  • Equipment Rental Script VendorPHP Jabbers Affected before 2.1 Fixed in 2.1 Patch available CNA
  • Food Delivery Script VendorPHP Jabbers Affected before 4.1 Fixed in 4.1 Patch available CNA
  • Member Login Script VendorPHP Jabbers Affected before 4.1 Fixed in 4.1 Patch available CNA
  • Member Directory Script VendorPHP Jabbers Affected before 2.1 Fixed in 2.1 Patch available CNA
  • Availability Calendar VendorPHP Jabbers Affected before 6.1 Fixed in 6.1 Patch available CNA
  • PHP Event Calendar VendorPHP Jabbers Affected before 4.1 Fixed in 4.1 Patch available CNA
  • PHP Newsletter Script VendorPHP Jabbers Affected before 5.1 Fixed in 5.1 Patch available CNA
  • Product Comparison Script VendorPHP Jabbers Affected before 2.1 Fixed in 2.1 Patch available CNA
  • Ticket Support Script VendorPHP Jabbers Affected before 4.1 Fixed in 4.1 Patch available CNA
  • PHP Shopping Cart VendorPHP Jabbers Affected before 6.0 Fixed in 6.0 Patch available CNA
  • Auto Classifieds Script VendorPHP Jabbers Affected before 4.1 Fixed in 4.1 Patch available CNA
  • Business Directory Script VendorPHP Jabbers Affected before 4.1 Fixed in 4.1 Patch available CNA
  • Availability Booking Calendar VendorPHP Jabbers Affected before 6.1 Fixed in 6.1 Patch available CNA
  • Time Slots Booking Calendar VendorPHP Jabbers Affected before 5.1 Fixed in 5.1 Patch available CNA
  • Restaurant Booking System VendorPHP Jabbers Affected before 4.1 Fixed in 4.1 Patch available CNA
  • Shuttle Booking Software VendorPHP Jabbers Affected before 3.1 Fixed in 3.1 Patch available CNA
  • Meeting Room Booking System VendorPHP Jabbers Affected before 2.1 Fixed in 2.1 Patch available CNA
  • Rental Property Booking Calendar VendorPHP Jabbers Affected before 3.1 Fixed in 3.1 Patch available CNA
  • Service Booking Script VendorPHP Jabbers Affected before 2.1 Fixed in 2.1 Patch available CNA
  • Limo Booking Software VendorPHP Jabbers Affected before 2.1 Fixed in 2.1 Patch available CNA
  • Taxi Booking Script VendorPHP Jabbers Affected before 3.1 Fixed in 3.1 Patch available CNA
  • Job Listing Script VendorPHP Jabbers Affected before 4.1 Fixed in 4.1 Patch available CNA
  • Property Listing Script VendorPHP Jabbers Affected before 4.1 Fixed in 4.1 Patch available CNA
  • Travel Tours Script VendorPHP Jabbers Affected before 3.1 Fixed in 3.1 Patch available CNA
  • Vacation Rental Script VendorPHP Jabbers Affected before 5.1 Fixed in 5.1 Patch available CNA
  • Yacht Listing Script VendorPHP Jabbers Affected before 3.1 Fixed in 3.1 Patch available CNA

Remediation

  • Fix · CNA Appointment Scheduler (PHP Jabbers) Fixed in 4.1
  • Fix · CNA Bus Reservation System (PHP Jabbers) Fixed in 2.1
  • Fix · CNA Car Park Booking System (PHP Jabbers) Fixed in 4.1
  • Fix · CNA Car Rental Script (PHP Jabbers) Fixed in 4.1
  • Fix · CNA Cinema Booking System (PHP Jabbers) Fixed in 2.1
  • Fix · CNA Event Booking Calendar (PHP Jabbers) Fixed in 5.1
  • Fix · CNA Event Ticketing System (PHP Jabbers) Fixed in 2.1
  • Fix · CNA Hotel Booking System (PHP Jabbers) Fixed in 5.1
  • Fix · CNA Cleaning Business Software (PHP Jabbers) Fixed in 2.1
  • Fix · CNA Equipment Rental Script (PHP Jabbers) Fixed in 2.1
  • Fix · CNA Food Delivery Script (PHP Jabbers) Fixed in 4.1
  • Fix · CNA Member Login Script (PHP Jabbers) Fixed in 4.1
  • Fix · CNA Member Directory Script (PHP Jabbers) Fixed in 2.1
  • Fix · CNA Availability Calendar (PHP Jabbers) Fixed in 6.1
  • Fix · CNA PHP Event Calendar (PHP Jabbers) Fixed in 4.1
  • Fix · CNA PHP Newsletter Script (PHP Jabbers) Fixed in 5.1
  • Fix · CNA Product Comparison Script (PHP Jabbers) Fixed in 2.1
  • Fix · CNA Ticket Support Script (PHP Jabbers) Fixed in 4.1
  • Fix · CNA PHP Shopping Cart (PHP Jabbers) Fixed in 6.0
  • Fix · CNA Auto Classifieds Script (PHP Jabbers) Fixed in 4.1
  • Fix · CNA Business Directory Script (PHP Jabbers) Fixed in 4.1
  • Fix · CNA Availability Booking Calendar (PHP Jabbers) Fixed in 6.1
  • Fix · CNA Time Slots Booking Calendar (PHP Jabbers) Fixed in 5.1
  • Fix · CNA Restaurant Booking System (PHP Jabbers) Fixed in 4.1
  • Fix · CNA Shuttle Booking Software (PHP Jabbers) Fixed in 3.1
  • Fix · CNA Meeting Room Booking System (PHP Jabbers) Fixed in 2.1
  • Fix · CNA Rental Property Booking Calendar (PHP Jabbers) Fixed in 3.1
  • Fix · CNA Service Booking Script (PHP Jabbers) Fixed in 2.1
  • Fix · CNA Limo Booking Software (PHP Jabbers) Fixed in 2.1
  • Fix · CNA Taxi Booking Script (PHP Jabbers) Fixed in 3.1
  • Fix · CNA Job Listing Script (PHP Jabbers) Fixed in 4.1
  • Fix · CNA Property Listing Script (PHP Jabbers) Fixed in 4.1
  • Fix · CNA Travel Tours Script (PHP Jabbers) Fixed in 3.1
  • Fix · CNA Vacation Rental Script (PHP Jabbers) Fixed in 5.1
  • Fix · CNA Yacht Listing Script (PHP Jabbers) Fixed in 3.1

Fixed in the same release

Records fixed by the same vendor advisory or release, as the CNA lists them.

  • Release ·

    PHP Jabbers Car Rental Script 4.1

    3 records Highest priority Priority MEDIUM 1 MEDIUM, 2 LOW

    Other records, highest priority first

    • TI-2025-41392 Unauthenticated SQL Injection in PHP Jabbers - Car Rental Script scriptPriority MEDIUM 48
    • TI-2025-41394 CSRF in PHP Jabbers scriptsPriority LOW 30
    Show all 3 records →
  • Release ·

    PHP Jabbers Appointment Scheduler, Auto Classifieds Script and 32 more products 2.1, 3.1 and 4 more versions

    2 records Highest priority Priority LOW 2 LOW

    Other records, highest priority first

    Show all 2 records →

Timeline

  1. 2026-10-02 Threatist record created from CVE-2025-67650
  2. 2026-10-03 Alias added: GHSA-h3q5-7qh5-pg2p

References

Advisory 1

Other 1

  • TI-2023-03812 PHP Jabbers Taxi Booking index.php cross site scripting CVSS 3.1MEDIUM 6.1
  • TI-2023-03806 PHP Jabbers Availability Booking Calendar index.php cross site scripting CVSS 3.1MEDIUM 6.1
  • TI-2025-41392 Unauthenticated SQL Injection in PHP Jabbers - Car Rental Script script CVSS 4.0CRITICAL 9.3
  • TI-2026-34253 Authenticated SQL Injection in PHP Poll Script CVSS 4.0HIGH 8.6
  • TI-2023-03811 PHP Jabbers Cleaning Business index.php cross site scripting CVSS 3.1MEDIUM 6.1
  • TI-2023-03810 PHP Jabbers Night Club Booking Software index.php cross site scripting CVSS 3.1MEDIUM 6.1
See all 13 →

Sources

This product uses the NVD API but is not endorsed or certified by the NVD. Sources and licences