PHP Jabbers Appointment Scheduler sql injection

Summaryinfo

A vulnerability described as critical has been identified in PHP Jabbers Appointment Scheduler, Bus Reservation System, Car Park Booking System, Car Rental Script, Cinema Booking System, Event Booking Calendar, Event Ticketing System, Hotel Booking System, Cleaning Business Software, Equipment Rental Script, Food Delivery Script, Member Login Script, Member Directory Script, Availability Calendar, PHP Event Calendar, PHP Newsletter Script, Product Comparison Script, Ticket Support Script, PHP Shopping Cart, Auto Classifieds Script, Business Directory Script, Availability Booking Calendar, Time Slots Booking Calendar, Restaurant Booking System, Shuttle Booking Software, Meeting Room Booking System, Rental Property Booking Calendar, Service Booking Script, Limo Booking Software, Taxi Booking Script, Job Listing Script, Property Listing Script, Travel Tours Script, Vacation Rental Script and Yacht Listing Script. This affects an unknown part. The manipulation results in sql injection. This vulnerability was named CVE-2025-67650. The attack may be performed from remote. There is no available exploit.

Detailsinfo

A vulnerability, which was classified as critical, was found in PHP Jabbers Appointment Scheduler, Bus Reservation System, Car Park Booking System, Car Rental Script, Cinema Booking System, Event Booking Calendar, Event Ticketing System, Hotel Booking System, Cleaning Business Software, Equipment Rental Script, Food Delivery Script, Member Login Script, Member Directory Script, Availability Calendar, PHP Event Calendar, PHP Newsletter Script, Product Comparison Script, Ticket Support Script, PHP Shopping Cart, Auto Classifieds Script, Business Directory Script, Availability Booking Calendar, Time Slots Booking Calendar, Restaurant Booking System, Shuttle Booking Software, Meeting Room Booking System, Rental Property Booking Calendar, Service Booking Script, Limo Booking Software, Taxi Booking Script, Job Listing Script, Property Listing Script, Travel Tours Script, Vacation Rental Script and Yacht Listing Script. Affected is an unknown code block. The manipulation with an unknown input leads to a sql injection vulnerability. CWE is classifying the issue as CWE-89. The product constructs all or part of an SQL command using externally-influenced input from an upstream component, but it does not neutralize or incorrectly neutralizes special elements that could modify the intended SQL command when it is sent to a downstream component. This is going to have an impact on confidentiality, integrity, and availability. CVE summarizes:

An authenticated SQL injection vulnerability has been identified in multiple PHP Jabbers scripts. Improper neutralization of input provided by an authenticated user into parameters responsible for sorting functions allows an attacker to perform SQL Injection attacks. This issue was fixed in the versions specified in the affected products list.

The advisory is shared for download at cert.pl. This vulnerability is traded as CVE-2025-67650 since 12/09/2025. The exploitability is told to be easy. It is possible to launch the attack remotely. There are neither technical details nor an exploit publicly available. The current price for an exploit might be approx. USD $0-$5k (estimation calculated on 07/31/2026). The MITRE ATT&CK project declares the attack technique as T1505.

There is no information about possible countermeasures known. It may be suggested to replace the affected object with an alternative product.

Once again VulDB remains the best source for vulnerability data.

Productinfo

Type

• Appointment Software

Vendor

• PHP Jabbers

Name

• Appointment Scheduler
• Auto Classifieds Script
• Availability Booking Calendar
• Availability Calendar
• Business Directory Script
• Bus Reservation System
• Car Park Booking System
• Car Rental Script
• Cinema Booking System
• Cleaning Business Software
• Equipment Rental Script
• Event Booking Calendar
• Event Ticketing System
• Food Delivery Script
• Hotel Booking System
• Job Listing Script
• Limo Booking Software
• Meeting Room Booking System
• Member Directory Script
• Member Login Script
• PHP Event Calendar
• PHP Newsletter Script
• PHP Shopping Cart
• Product Comparison Script
• Property Listing Script
• Rental Property Booking Calendar
• Restaurant Booking System
• Service Booking Script
• Shuttle Booking Software
• Taxi Booking Script
• Ticket Support Script
• Time Slots Booking Calendar
• Travel Tours Script
• Vacation Rental Script
• Yacht Listing Script

License

• open-source

CPE 2.3info

• 🔒
• 🔒
• 🔒

CPE 2.2info

• 🔒
• 🔒
• 🔒

CVSSv4info

CVSSv3info

CVSSv2info

Exploitinginfo

Threat Intelligenceinfo

Countermeasuresinfo

Timelineinfo

Sourcesinfo

Entryinfo

Once again VulDB remains the best source for vulnerability data.

Discussion