Which versions of Car Rental Script are affected by EUVD-2025-210566?

PHP Jabbers Car Rental Script versions prior to 4.1 contain a critical SQL injection vulnerability in public-facing sorting parameters that allows unauthenticated attackers to read and modify backend…. A patch is available.

How to fix or mitigate EUVD-2025-210566?

Within 24 hours, inventory all systems running PHP Jabbers Car Rental Script and document internet exposure; immediately implement input validation and deploy WAF rules to block SQL injection patterns targeting sorting parameters as a temporary measure. Within 7 days, upgrade to version 4.1 or later across all production systems after testing compatibility in a staging environment. Within 30 days, complete any deferred upgrades on non-production systems, conduct database integrity audits to identify potential unauthorized access or modifications, and establish automated patch management procedures to ensure timely security updates.

Car Rental Script EUVD-2025-210566

Q: What is the CVSS score of EUVD-2025-210566?

EUVD-2025-210566 has a CVSS 4.0 base score of 9.3 (Critical). CVSS vector: CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:L/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X. EPSS exploitation probability: 0.3%.

| CVE-2025-67649 CRITICAL

SQL Injection (CWE-89)

2026-07-31 cvd@cert.pl

GHSA-jfpp-p8m5-m237

SQLi PHP

9.3

CVSS 4.0 · Vendor: cert

Severity by source

Vendor (cert) PRIMARY

9.3 CRITICAL

CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:L/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X

vuln.today AI

9.4 CRITICAL

Unauthenticated network-reachable sort parameter (AV:N/AC:L/PR:N/UI:N); SQLi yields high confidentiality and integrity with limited availability impact.

3.1 AV:N/AC:L/PR:N/UI:N/S:N/C:H/I:H/A:L

4.0 AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:L/SC:N/SI:N/SA:N

Primary rating from Vendor (cert).

CVSS VectorVendor: cert

CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:L/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X

Attack Vector

Network

Attack Complexity

Low

Privileges Required

None

User Interaction

None

Scope

Lifecycle Timeline

Patch available

Jul 31, 2026 - 13:01 EUVD

Analysis Generated

Jul 31, 2026 - 12:30 vuln.today

CVE Published

Jul 31, 2026 - 12:16 cve.org

CRITICAL 9.3

DescriptionCVE.org

A SQL injection vulnerability has been identified in PHP Jabbers - Car Rental Script . Improper neutralization of input provided by user into parameters responsible for sorting functions allows an unauthenticated attacker to perform SQL Injection attacks.

This issue was fixed in version 4.1.

Articles & Coverage 1

News Critical SQL Injection in PHP Jabbers Car Rental Script - CVE-2025-67649 Aug 01, 2026

AnalysisAI

SQL injection in PHP Jabbers Car Rental Script allows unauthenticated remote attackers to inject arbitrary SQL through sorting-related parameters that are not properly neutralized before use in database queries. The flaw (CWE-89) carries a CVSS 4.0 base score of 9.3 and enables reading or manipulating backend database contents; there is no public exploit identified at time of analysis, and it is fixed in version 4.1. Because sorting parameters are typically reachable on public-facing catalog/listing pages, exploitation requires no credentials or user interaction.

Technical ContextAI

PHP Jabbers Car Rental Script is a commercial PHP web application used by car-rental businesses to manage fleet listings, bookings and reservations, backed by a relational SQL database (typically MySQL/MariaDB). The root cause is CWE-89 (Improper Neutralization of Special Elements used in an SQL Command): user-controlled values passed to sorting functions - commonly ORDER BY column or direction parameters - are concatenated into SQL statements without parameterization or an allow-list. ORDER BY clauses are a classic SQLi weak point because column identifiers cannot be bound as prepared-statement placeholders, so developers often interpolate them directly, making them injectable when input is not validated against a fixed set of allowed columns.

RemediationAI

Vendor-released patch: version 4.1 - upgrade the Car Rental Script to 4.1 or later, which remediates the sorting-parameter SQL injection. Until the upgrade can be applied, restrict access to the affected listing/sorting endpoints (for example via IP allow-listing or authentication at the web-server layer) and deploy a WAF rule to block SQL metacharacters and typical ORDER BY injection patterns on sort parameters, accepting that WAF filtering can be bypassed and may produce false positives on legitimate sort values. As a code-level compensating control if self-hosting the source, enforce a strict allow-list mapping user sort inputs to fixed column names and directions rather than interpolating raw input. Refer to the CERT Polska advisory at https://cert.pl/en/posts/2026/07/CVE-2025-67649/ and the vendor page https://www.phpjabbers.com/car-rental-script/ for authoritative guidance.