# PHP Jabbers Scripts Patch Multiple Vulnerabilities

Published: 2026-07-31 · Severity: medium
Canonical: https://vorant.io/reports/5466e5b8-0671-5b31-ac59-79342e59d231/php-jabbers-scripts-patch-multiple-vulnerabilities

> CERT Polska coordinated disclosure of SQL injection, XSS, and CSRF vulnerabilities across multiple PHP Jabbers scripts, now fixed in version 4.1.

CERT Polska coordinated the responsible disclosure of five vulnerabilities affecting multiple PHP Jabbers scripts, including the Car Rental Script and PHP Poll Script. The most severe issue, CVE-2025-67649, allows an unauthenticated attacker to perform SQL injection via improperly sanitized sorting parameters in the Car Rental Script. Additional SQL injection flaws (CVE-2026-46593, CVE-2025-67650) require authentication but similarly stem from unsanitized input in sorting and admin controller parameters. A reflected XSS vulnerability (CVE-2026-46594) and a CSRF vulnerability (CVE-2025-67651) round out the disclosure, with the CSRF issue notably enabling attackers to create unauthorized admin accounts due to missing CSRF tokens or SameSite cookie attributes.

All vulnerabilities have been fixed in version 4.1 or later depending on the specific script affected. There is no indication of active exploitation in the wild; this is a coordinated vulnerability disclosure with credit given to researchers Kamil Szczurowski and Robert Kruczek. Organizations using PHP Jabbers scripts should apply the available patches, particularly given the unauthenticated SQL injection vector which poses the greatest immediate risk if left unpatched.

## Mentioned in this report

- Vulnerabilities: CVE-2025-67649, CVE-2025-67650, CVE-2025-67651, CVE-2026-46593, CVE-2026-46594

## Detection guidance (public sample)

### SQL Injection Attempt via Sorting Parameter in Web Request

ATT&CK: T1190

Detects SQL injection payloads embedded in sort/order query parameters, matching the unauthenticated CVE-2025-67649 pattern where sorting parameters in Car Rental Script and similar PHP web apps are unsanitized. Auto-generated starting point — validate and tune in your environment before deploying. IOC matches can false-positive on shared infrastructure and decay as adversary infrastructure rotates.

```yaml
title: SQL Injection Attempt via Sorting Parameter in Web Request
description: Detects SQL injection syntax appearing within sort/order-style query
  parameters, consistent with unauthenticated SQL injection via improperly sanitized
  sorting parameters as disclosed in PHP Jabbers scripts (CVE-2025-67649). Generalises
  on the parameter naming convention and injection syntax rather than a specific payload
  or endpoint.
tags:
- attack.initial_access
- attack.t1190
logsource:
  category: webserver
detection:
  selection_param:
    cs-uri-query|contains:
    - sort=
    - order=
    - orderby=
    - sortby=
    - sort_by=
    - order_by=
  selection_sqli:
    cs-uri-query|contains:
    - UNION SELECT
    - union select
    - SLEEP(
    - sleep(
    - ''' OR ''1''=''1'
    - ' OR 1=1'
    - --+
    - benchmark(
  condition: selection_param and selection_sqli
falsepositives:
- Legitimate free-text search or sort values that coincidentally contain SQL-like
  keywords
- Authorized vulnerability scanners or penetration testers probing sorting parameters
level: medium
id: 7fa639a9-ca99-52ce-8eca-f8728a23ef31
status: experimental
author: Vorant
```

### SQL Injection Attempt via Admin Controller Parameter

ATT&CK: T1190

Detects SQL injection syntax within admin/controller query parameters after authentication, matching CVE-2025-67650 style flaws in PHP Jabbers admin panels. Auto-generated starting point — validate and tune in your environment before deploying. IOC matches can false-positive on shared infrastructure and decay as adversary infrastructure rotates.

```yaml
title: SQL Injection Attempt via Admin Controller Parameter
description: Detects SQL injection syntax within requests to admin/controller-style
  endpoints, consistent with authenticated SQL injection flaws stemming from unsanitized
  admin controller parameters (e.g. CVE-2025-67650, CVE-2026-46593) disclosed for
  PHP Jabbers scripts. Generalises on the endpoint naming pattern and injection syntax
  rather than a specific parameter name or payload.
tags:
- attack.initial_access
- attack.t1190
logsource:
  category: webserver
detection:
  selection_endpoint:
    cs-uri-stem|contains:
    - /admin
    - controller
  selection_sqli:
    cs-uri-query|contains:
    - UNION SELECT
    - union select
    - SLEEP(
    - sleep(
    - ''' OR ''1''=''1'
    - ' OR 1=1'
    - --+
    - benchmark(
    - information_schema
  condition: selection_endpoint and selection_sqli
falsepositives:
- Legitimate administrative queries or reporting tools that reference database schema
  terms
- Internal security testing of admin panel input validation
level: medium
id: e5c49c25-2592-5fc4-8bbf-67f89feea84c
status: experimental
author: Vorant
```

Behavioural rules are generated from public reporting — validate in your environment before deploying.

Source reporting: https://cert.pl/en/posts/2026/07/CVE-2025-67649

---

This is the free public brief from Vorant Threat Intelligence. When citing, attribute "Vorant" and link https://vorant.io/reports/5466e5b8-0671-5b31-ac59-79342e59d231/php-jabbers-scripts-patch-multiple-vulnerabilities.
Full IOC sets, deployable detections, the entity graph, TAXII 2.1 feed and real-time alerts: https://vorant.io/signup