# CVE-2025-67649: Unauthenticated SQL Injection in PHP Jabbers Car Rental Script (<4.1)

> CERT Polska disclosed CVE-2025-67649, an unauthenticated SQL injection (CWE-89) in PHP Jabbers' Car Rental Script affecting all versions before 4.1. NVD has since scored the flaw CVSS v4.0 9.3 (CRITICAL): improper neutralization of user input in parameters responsible for sorting functions lets a remote, unauthenticated attacker inject arbitrary SQL with no privileges and no user interaction required. Version 4.1 is patched; the CVE was disclosed alongside four related CVEs (CVE-2025-67650, CVE-2025-67651, CVE-2026-46593, CVE-2026-46594) affecting 35 total PHP Jabbers products.

- **Published:** 2026-07-31T12:16:48Z
- **Last reviewed:** 2026-07-31T12:16:48Z
- **Canonical:** https://intel.threadlinqs.com/threat/TL-2026-1799
- **ID:** TL-2026-1799
- **Severity:** CRITICAL (CVSS 9.3)
- **Category:** VULNERABILITY
- **Status:** ACTIVE
- **Detections:** 9 · **IOCs:** 18 (full data via the Threadlinqs MCP server — Purple tier)
- **CVEs:** CVE-2025-67649, CVE-2025-67650, CVE-2025-67651, CVE-2026-46593, CVE-2026-46594

## Description

PHP Jabbers is a vendor of self-hosted, PHP/MySQL-backed booking and reservation scripts sold as one-time-purchase source code, hosted SaaS, or complete white-label websites. Its Car Rental Script product manages vehicle inventory, customer bookings, and payment processing (PayPal, Authorize.net, card gateways) through a controller/action MVC routing layer (index.php?controller=...&action=...) fronting a MySQL database, with an admin panel used by rental-company staff to manage bookings, pricing, and users.

CERT Polska's 31 July 2026 coordinated-disclosure advisory, credited to researchers Kamil Szczurowski and Robert Kruczek, describes CVE-2025-67649 as improper neutralization of user-supplied input in the parameters that drive sorting functions across the application's listing views. Because these sorting parameters are consumed directly in SQL ORDER BY / sort-column logic without adequate validation or parameterization, an attacker who sends nothing more than a crafted HTTP request (no authentication, no user interaction, low complexity, per the published CVSS v4.0 vector AV:N/AC:L/AT:N/PR:N/UI:N) can inject arbitrary SQL. NVD has assigned this flaw CVSS v4.0 base score 9.3 (CRITICAL: VC:H/VI:H/VA:L), reflecting high confidentiality and integrity impact against the backing database and a lower (but non-zero) availability impact, consistent with classic UNION-based, boolean-blind, error-based, or time-based extraction techniques against an ORDER BY injection point.

Exploitation of a sort-parameter SQLi of this class typically proceeds through schema/version enumeration (information_schema abuse), then extraction of customer PII, booking/payment records, and administrator credential hashes stored in the same database, with escalation paths into the admin panel if extracted credentials are reused, and — depending on database user privileges and secure_file_priv/FILE-privilege configuration — potential webshell drop via INTO OUTFILE for follow-on code execution and persistence. No CVSS score or confirmed in-the-wild exploitation had been published at the moment CERT Polska's advisory first surfaced in the harness's RSS ingest; NVD's subsequent CVSS v4.0 9.3 score and the absence of this CVE (or its four sibling CVEs) from the CISA Known Exploited Vulnerabilities catalog (2026-07-29 snapshot) indicate the flaw is disclosed-but-not-yet-weaponized-in-public as of this research pass. The same CERT Polska advisory batch discloses four related weaknesses across the broader PHP Jabbers product line: CVE-2025-67650 (authenticated SQL injection via sorting parameters, multiple products), CVE-2025-67651 (CSRF enabling unauthorized admin actions including admin account creation, multiple products), CVE-2026-46593 (authenticated SQL injection in PHP Poll Script's pjAdminPolls.controller.php), and CVE-2026-46594 (reflected XSS in PHP Poll Script). These are tracked as separate CVE identifiers and are out of scope for this record but establish that PHP Jabbers' shared codebase pattern (unvalidated GET/POST parameters feeding both SQL and page rendering) is a systemic weakness across the vendor's 35-product catalog, not an isolated defect.

PHP Jabbers Car Rental Script is patched in version 4.1, which the vendor's product page notes also adds PHP 8+ compatibility and CSRF protection improvements. Organizations running any version below 4.1 should treat this as pre-authentication, remotely exploitable database compromise risk against an internet-facing, revenue-processing booking application and prioritize patching or compensating WAF controls accordingly.

## MITRE ATT&CK

- T1595.002 Vulnerability Scanning
- T1596.005 Scan Databases
- T1592.002 Software
- T1590.002 DNS
- T1588.002 Tool
- T1587.001 Malware
- T1190 Exploit Public-Facing Application
- T1505.003 Web Shell
- T1136.001 Local Account
- T1068 Exploitation for Privilege Escalation
- T1078.001 Default Accounts
- T1027.010 Command Obfuscation
- T1140 Deobfuscate/Decode Files or Information
- T1552.001 Credentials In Files
- T1110.002 Password Cracking
- T1555 Credentials from Password Stores
- T1082 System Information Discovery
- T1046 Network Service Discovery
- T1518 Software Discovery
- T1210 Exploitation of Remote Services
- T1213 Data from Information Repositories
- T1005 Data from Local System
- T1071.001 Web Protocols
- T1041 Exfiltration Over C2 Channel
- T1565.001 Stored Data Manipulation

## Sources

- [CVE-2025-67649 - SQL Injection in Car Rental Script (PHP Jabbers)](https://cert.pl/en/posts/2026/07/CVE-2025-67649/)
- [CVE-2025-67649 Detail - NVD](https://nvd.nist.gov/vuln/detail/CVE-2025-67649)
- [PHP Jabbers - Car Rental Script (vendor product page)](https://www.phpjabbers.com/car-rental-script/)
- [Vulnerabilities in PHP Jabbers scripts - Malware News](https://malware.news/t/vulnerabilities-in-php-jabbers-scripts/124400)
- [Multiple Vulnerabilities in PHP Jabbers Scripts - BCK Security](https://medium.com/@bcksec/multiple-vulnerabilities-in-php-jabbers-scripts-25af4afcadd4)
- [CISA Known Exploited Vulnerabilities Catalog (queried for CVE-2025-67649 - not listed)](https://www.cisa.gov/sites/default/files/feeds/known_exploited_vulnerabilities.json)
- [PHPJabbers Car Rental Script - Multiple Vulnerabilities (historical XSS/CSRF PoC, same product line)](https://www.exploit-db.com/exploits/30912)

## Full data

Detection queries (Splunk SPL / Microsoft KQL / Sigma) and IOC values require the Threadlinqs MCP server (Purple tier): https://intel.threadlinqs.com/mcp

Canonical: https://intel.threadlinqs.com/threat/TL-2026-1799