Which versions of PHP Jabbers are affected by CVE-2025-67650?

PHP Jabbers scripts contain a SQL injection vulnerability (CVSS 8.6) in sorting parameters enabling attackers to access and modify application data.. A patch is available.

How to fix or mitigate CVE-2025-67650?

Within 24 hours, identify all PHP Jabbers deployments in your environment and audit database access logs for suspicious sorting parameter activity. Within 7 days, contact the PHP Jabbers vendor to obtain exact patch version numbers and deploy patches to all systems immediately. Within 30 days, verify patch application completeness, implement database query audit logging to detect ongoing injection attempts, and review database account privileges to enforce least-privilege access principles.

PHP Jabbers CVE-2025-67650

Q: What is the CVSS score of CVE-2025-67650?

CVE-2025-67650 has a CVSS 4.0 base score of 8.6 (High). CVSS vector: CVSS:4.0/AV:N/AC:L/AT:N/PR:H/UI:N/VC:H/VI:H/VA:L/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X. EPSS exploitation probability: 0.3%.

EUVD-2025-210567 HIGH

SQL Injection (CWE-89)

2026-07-31 cvd@cert.pl

GHSA-h3q5-7qh5-pg2p

PHP SQLi

8.6

CVSS 4.0 · Vendor: cert

Severity by source

Vendor (cert) PRIMARY

8.6 HIGH

CVSS:4.0/AV:N/AC:L/AT:N/PR:H/UI:N/VC:H/VI:H/VA:L/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X

vuln.today AI

8.3 HIGH

Network-reachable low-complexity SQLi requiring an authenticated account (PR:L, as the description says only 'authenticated user'); SQLi yields high confidentiality/integrity and limited availability impact.

3.1 AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:L

4.0 AV:N/AC:L/AT:N/PR:L/UI:N/VC:H/VI:H/VA:L/SC:N/SI:N/SA:N

Primary rating from Vendor (cert).

CVSS VectorVendor: cert

Attack Vector

Network

Attack Complexity

Low

Privileges Required

High

User Interaction

None

Scope

Lifecycle Timeline

Patch available

Jul 31, 2026 - 13:01 EUVD

Analysis Generated

Jul 31, 2026 - 12:30 vuln.today

CVE Published

Jul 31, 2026 - 12:16 cve.org

HIGH 8.6

DescriptionCVE.org

An authenticated SQL injection vulnerability has been identified in multiple PHP Jabbers scripts. Improper neutralization of input provided by an authenticated user into parameters responsible for sorting functions allows an attacker to perform SQL Injection attacks. This issue was fixed in the versions specified in the affected products list.

AnalysisAI

SQL injection in multiple PHP Jabbers PHP scripts allows an authenticated user to inject arbitrary SQL through the sorting parameters, enabling database read and modification. Reported by CERT Polska (cert.pl) and classified as CWE-89, it carries a CVSS 4.0 base score of 8.6; no public exploit identified at time of analysis and it is not listed in CISA KEV. The vendor states the issue is fixed in updated versions listed in the (not-provided) affected-products list, so patched builds exist but exact fix versions are not confirmed in the supplied data.

Technical ContextAI

PHP Jabbers publishes a family of commercial off-the-shelf PHP web scripts (booking, scheduling, classifieds, rental and similar applications) that share common code patterns. The root cause is CWE-89 (Improper Neutralization of Special Elements used in an SQL Command): user-controllable values passed to sorting functions (typically ORDER BY / sort-column or sort-direction request parameters) are concatenated into SQL statements without parameterization or allowlist validation. Because ORDER BY clauses cannot be parameterized with bound values in most database drivers, developers frequently interpolate the column/direction directly, which is exactly the class of mistake exploited here. The CVSS 4.0 vector (VC:H/VI:H/VA:L) indicates the injection yields high confidentiality and integrity impact against the underlying database with limited availability effect.

RemediationAI

Apply the vendor-updated builds: Patch available per vendor advisory - PHP Jabbers states the issue is fixed in updated versions, but the exact fixed version numbers were not provided in this data, so obtain the current patched release for each deployed script directly from https://www.phpjabbers.com/ and consult the CERT Polska advisory (https://cert.pl/en/posts/2026/07/CVE-2025-67649/) for specifics. Until patched, restrict access to the affected admin/authenticated interfaces (IP allowlisting or VPN-only access to the management panel), revoke or tighten low-privilege accounts that can reach sorting-enabled pages, and place a WAF rule in front of the sort parameters to reject SQL metacharacters and enforce an allowlist of valid sort columns/directions - the trade-off is that overly strict WAF rules may break legitimate sorting and column selection. Auditing database accounts used by the scripts to enforce least privilege (read-only where possible, no DDL/file privileges) limits the blast radius of a successful injection.