Threat reportVulnerabilityTL-2026-1799

CVE-2025-67649: Unauthenticated SQL Injection in PHP Jabbers Car Rental Script (<4.1)

criticalACTIVE

CVE-2025-67649 (TL-2026-1799) is a critical-severity software vulnerability scored CVSS 9.3, first published 2026-07-31. It has no confirmed attribution, affects PHP Jabbers Car Rental Script, references 5 CVEs (CVE-2025-67649, CVE-2025-67650, CVE-2025-67651), maps to 25 MITRE ATT&CK techniques (T1005, T1027.010, T1041), and is covered by 9 detection rules and 18 indicators of compromise.

CVSS
9.3/10Critical
CVEs
5Referenced vulnerabilities
Techniques
25MITRE ATT&CK
Actors
0Not attributed
Detection rules
9SPL · KQL · Sigma
IOCs
18Indicators of compromise

Key facts for TL-2026-1799

Threat ID
TL-2026-1799
Severity
CRITICAL
CVSS
9.3 (CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:L/SC:N/SI:N/SA:N)
Status
ACTIVE
Category
VULNERABILITY
First published
Last reviewed
Attribution confidence
LOW
Motivation
UNKNOWN
Target sectors
transport, hospitality, ecommerce, small-and-medium-business
Target regions
Global
Detection rules
9
Indicators of compromise
18

Malware and tooling in CVE-2025-67649

Malware and tooling: sqlmap - S0225

How CVE-2025-67649 works

CERT Polska disclosed CVE-2025-67649, an unauthenticated SQL injection (CWE-89) in PHP Jabbers' Car Rental Script affecting all versions before 4.1. NVD has since scored the flaw CVSS v4.0 9.3 (CRITICAL): improper neutralization of user input in parameters responsible for sorting functions lets a remote, unauthenticated attacker inject arbitrary SQL with no privileges and no user interaction required. Version 4.1 is patched; the CVE was disclosed alongside four related CVEs (CVE-2025-67650, CVE-2025-67651, CVE-2026-46593, CVE-2026-46594) affecting 35 total PHP Jabbers products.

PHP Jabbers is a vendor of self-hosted, PHP/MySQL-backed booking and reservation scripts sold as one-time-purchase source code, hosted SaaS, or complete white-label websites. Its Car Rental Script product manages vehicle inventory, customer bookings, and payment processing (PayPal, Authorize.net, card gateways) through a controller/action MVC routing layer (index.php?controller=...&action=...) fronting a MySQL database, with an admin panel used by rental-company staff to manage bookings, pricing, and users.

CERT Polska's 31 July 2026 coordinated-disclosure advisory, credited to researchers Kamil Szczurowski and Robert Kruczek, describes CVE-2025-67649 as improper neutralization of user-supplied input in the parameters that drive sorting functions across the application's listing views. Because these sorting parameters are consumed directly in SQL ORDER BY / sort-column logic without adequate validation or parameterization, an attacker who sends nothing more than a crafted HTTP request (no authentication, no user interaction, low complexity, per the published CVSS v4.0 vector AV:N/AC:L/AT:N/PR:N/UI:N) can inject arbitrary SQL. NVD has assigned this flaw CVSS v4.0 base score 9.3 (CRITICAL: VC:H/VI:H/VA:L), reflecting high confidentiality and integrity impact against the backing database and a lower (but non-zero) availability impact, consistent with classic UNION-based, boolean-blind, error-based, or time-based extraction techniques against an ORDER BY injection point.

Exploitation of a sort-parameter SQLi of this class typically proceeds through schema/version enumeration (information_schema abuse), then extraction of customer PII, booking/payment records, and administrator credential hashes stored in the same database, with escalation paths into the admin panel if extracted credentials are reused, and — depending on database user privileges and secure_file_priv/FILE-privilege configuration — potential webshell drop via INTO OUTFILE for follow-on code execution and persistence. No CVSS score or confirmed in-the-wild exploitation had been published at the moment CERT Polska's advisory first surfaced in the harness's RSS ingest; NVD's subsequent CVSS v4.0 9.3 score and the absence of this CVE (or its four sibling CVEs) from the CISA Known Exploited Vulnerabilities catalog (2026-07-29 snapshot) indicate the flaw is disclosed-but-not-yet-weaponized-in-public as of this research pass. The same CERT Polska advisory batch discloses four related weaknesses across the broader PHP Jabbers product line: CVE-2025-67650 (authenticated SQL injection via sorting parameters, multiple products), CVE-2025-67651 (CSRF enabling unauthorized admin actions including admin account creation, multiple products), CVE-2026-46593 (authenticated SQL injection in PHP Poll Script's pjAdminPolls.controller.php), and CVE-2026-46594 (reflected XSS in PHP Poll Script). These are tracked as separate CVE identifiers and are out of scope for this record but establish that PHP Jabbers' shared codebase pattern (unvalidated GET/POST parameters feeding both SQL and page rendering) is a systemic weakness across the vendor's 35-product catalog, not an isolated defect.

PHP Jabbers Car Rental Script is patched in version 4.1, which the vendor's product page notes also adds PHP 8+ compatibility and CSRF protection improvements. Organizations running any version below 4.1 should treat this as pre-authentication, remotely exploitable database compromise risk against an internet-facing, revenue-processing booking application and prioritize patching or compensating WAF controls accordingly.

MITRE ATT&CK techniques used in TL-2026-1799

Collection

T1005 Data from Local System; T1213 Data from Information Repositories

Defense Evasion

T1027.010 Command Obfuscation; T1140 Deobfuscate/Decode Files or Information

Exfiltration

T1041 Exfiltration Over C2 Channel

Discovery

T1046 Network Service Discovery; T1082 System Information Discovery; T1518 Software Discovery

Privilege Escalation

T1068 Exploitation for Privilege Escalation; T1078.001 Default Accounts

Command and Control

T1071.001 Web Protocols

Credential Access

T1110.002 Password Cracking; T1552.001 Credentials In Files; T1555 Credentials from Password Stores

Persistence

T1136.001 Local Account; T1505.003 Web Shell

Initial Access

T1190 Exploit Public-Facing Application

Lateral Movement

T1210 Exploitation of Remote Services

Impact

T1565.001 Stored Data Manipulation

Resource Development

T1587.001 Malware; T1588.002 Tool

Reconnaissance

T1590.002 DNS; T1592.002 Software; T1595.002 Vulnerability Scanning; T1596.005 Scan Databases

Affected products and versions in CVE-2025-67649

  • PHP Jabbers — Car Rental Script
    Vulnerable versions: All versions before 4.1
    Fixed in: 4.1

Remediation for CVE-2025-67649

Patches

  • Apply vendor patch — Car Rental Script version 4.1 (https://www.phpjabbers.com/car-rental-script/)

Immediate actions

  • Upgrade PHP Jabbers Car Rental Script to version 4.1 or later immediately
  • If immediate upgrade is not possible, deploy a WAF rule set in front of the application covering SQL injection patterns targeting ORDER BY / sort-column parameters (UNION SELECT, boolean/error-based tautologies, SLEEP()/BENCHMARK() time-delay payloads)
  • Audit and restrict direct internet exposure of booking-listing and admin-listing endpoints until patched
  • Rotate admin panel credentials and any database credentials that may have been reused elsewhere

Workarounds

  • If patching is delayed, disable or geo/IP-restrict public access to listing/sort-enabled endpoints until upgraded
  • Apply strict server-side allow-listing on any parameter controlling ORDER BY column name or sort direction

Longer-term hardening

  • Adopt parameterized queries / prepared statements for all dynamic ORDER BY and sort-column SQL construction across the codebase
  • Establish a recurring vulnerability management process covering PHP Jabbers' other 34 affected products in use by the organization
  • Deploy database activity monitoring / query logging with alerting on anomalous UNION, boolean, or time-based query patterns
  • Conduct periodic authenticated and unauthenticated penetration testing of self-hosted third-party booking software before renewal cycles

CVEs associated with CVE-2025-67649

CVE-2025-67649, CVE-2025-67650, CVE-2025-67651, CVE-2026-46593, CVE-2026-46594

Weaknesses (CWE) in CVE-2025-67649

CWE-89

Timeline of CVE-2025-67649

  • TL-Intel-Harness HUNT phase ingests the CERT Polska advisory via the CERT Polska (cert.pl) RSS feed and creates threat skeleton TL-2026-1799 for downstream RESEARCH.
  • The same advisory batch discloses related weaknesses across the PHP Jabbers product line: CVE-2025-67650 (authenticated sorting-parameter SQLi, multiple products), CVE-2025-67651 (CSRF enabling unauthorized admin actions), CVE-2026-46593 (authenticated SQLi in PHP Poll Script's pjAdminPolls.controller.php), and CVE-2026-46594 (reflected XSS in PHP Poll Script) — establishing a systemic unvalidated-parameter pattern across the vendor's 35-product catalog.
  • Cross-check against the CISA Known Exploited Vulnerabilities catalog (2026-07-29 snapshot, 1,656 entries) finds no listing for CVE-2025-67649 or its four sibling CVEs; no confirmed in-the-wild exploitation reported at time of research.
  • PHP Jabbers' Car Rental Script version 4.1 (also adding PHP 8+ compatibility and CSRF protection improvements) is confirmed as the fixed release; all versions before 4.1 remain vulnerable.
  • NVD assigns CVSS v4.0 base score 9.3 (CRITICAL) to CVE-2025-67649, vector AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:L, reflecting unauthenticated, no-user-interaction remote exploitability with high confidentiality/integrity impact.
  • NVD publishes the CVE-2025-67649 record (published/lastModified 2026-07-31T12:16:48Z) describing the sorting-parameter SQL injection in Car Rental Script versions before 4.1, resolved in 4.1.
  • The vulnerabilities are credited to security researchers Kamil Szczurowski and Robert Kruczek, reported to CERT Polska under its Coordinated Vulnerability Disclosure (CVD) policy.
  • CERT Polska publishes a coordinated vulnerability disclosure covering 5 CVEs (CVE-2025-67649 through CVE-2025-67651, CVE-2026-46593, CVE-2026-46594) affecting 35 PHP Jabbers scripts, including CVE-2025-67649: unauthenticated SQL injection via sorting-function parameters in Car Rental Script.

Sources cited for CVE-2025-67649

Detection coverage for TL-2026-1799

As of 2026-07-31, Threadlinqs Intelligence publishes 9 detection rule(s) for TL-2026-1799 across Splunk SPL, Microsoft KQL and Sigma, covering 18 indicator(s) of compromise. The whole corpus is readable without an account; a free account unlocks full detection query text in Splunk SPL, Microsoft KQL and Sigma; paid tiers add raw indicator values, correlation and the MCP server. Threadlinqs MCP server · View plans.

9 detection rules (Splunk SPL, Microsoft KQL, Sigma) · Blue and above. Compare plans
18 indicators of compromise · Red and above. Compare plans

Threadlinqs Intelligence — Real-Time Threat Detection Platform

[ 0 threats ] [ 0 det ] [ CRIT: 0 ] [ HIGH: 0 ]
// threat_feed
$ sort --newest
Showing all threats

Live intelligence console

Threat level
Fig. 01 · Threat weatherIndexing the archive…
1 square = 1 threat · click to open

Latest Threats