CVE-2025-67651 PUBLISHED

CSRF in PHP Jabbers scripts

Assigner: CERT-PL
Reserved: 09.12.2025 Published: 31.07.2026 Updated: 31.07.2026

A Cross-Site Request Forgery (CSRF) vulnerability has been identified in multiple PHP Jabbers scripts. The lack of CSRF tokens or appropriate SameSite attributes allows an attacker to send unauthorized requests in the context of an authenticated user, leading to unauthorized administrative actions, such as creating new admin accounts.

This issue was fixed in the versions specified in the affected products list.

Metrics

CVSS Vector: CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:A/VC:N/VI:H/VA:N/SC:N/SI:N/SA:N
CVSS Score: 6.9

Product Status

Vendor PHP Jabbers
Product Appointment Scheduler
Versions Default: unaffected
  • affected from 0 to 4.1 (excl.)
Vendor PHP Jabbers
Product Bus Reservation System
Versions Default: unaffected
  • affected from 0 to 2.1 (excl.)
Vendor PHP Jabbers
Product Car Park Booking System
Versions Default: unaffected
  • affected from 0 to 4.1 (excl.)
Vendor PHP Jabbers
Product Car Rental Script
Versions Default: unaffected
  • affected from 0 to 4.1 (excl.)
Vendor PHP Jabbers
Product Cinema Booking System
Versions Default: unaffected
  • affected from 0 to 2.1 (excl.)
Vendor PHP Jabbers
Product Event Booking Calendar
Versions Default: unaffected
  • affected from 0 to 5.1 (excl.)
Vendor PHP Jabbers
Product Event Ticketing System
Versions Default: unaffected
  • affected from 0 to 2.1 (excl.)
Vendor PHP Jabbers
Product Hotel Booking System
Versions Default: unaffected
  • affected from 0 to 5.1 (excl.)
Vendor PHP Jabbers
Product Cleaning Business Software
Versions Default: unaffected
  • affected from 0 to 2.1 (excl.)
Vendor PHP Jabbers
Product Equipment Rental Script
Versions Default: unaffected
  • affected from 0 to 2.1 (excl.)
Vendor PHP Jabbers
Product Food Delivery Script
Versions Default: unaffected
  • affected from 0 to 4.1 (excl.)
Vendor PHP Jabbers
Product Member Login Script
Versions Default: unaffected
  • affected from 0 to 4.1 (excl.)
Vendor PHP Jabbers
Product Member Directory Script
Versions Default: unaffected
  • affected from 0 to 2.1 (excl.)
Vendor PHP Jabbers
Product Availability Calendar
Versions Default: unaffected
  • affected from 0 to 6.1 (excl.)
Vendor PHP Jabbers
Product PHP Event Calendar
Versions Default: unaffected
  • affected from 0 to 4.1 (excl.)
Vendor PHP Jabbers
Product PHP Newsletter Script
Versions Default: unaffected
  • affected from 0 to 5.1 (excl.)
Vendor PHP Jabbers
Product Product Comparison Script
Versions Default: unaffected
  • affected from 0 to 2.1 (excl.)
Vendor PHP Jabbers
Product Ticket Support Script
Versions Default: unaffected
  • affected from 0 to 4.1 (excl.)
Vendor PHP Jabbers
Product PHP Shopping Cart
Versions Default: unaffected
  • affected from 0 to 6.0 (excl.)
Vendor PHP Jabbers
Product Auto Classifieds Script
Versions Default: unaffected
  • affected from 0 to 4.1 (excl.)
Vendor PHP Jabbers
Product Business Directory Script
Versions Default: unaffected
  • affected from 0 to 4.1 (excl.)
Vendor PHP Jabbers
Product Availability Booking Calendar
Versions Default: unaffected
  • affected from 0 to 6.1 (excl.)
Vendor PHP Jabbers
Product Time Slots Booking Calendar
Versions Default: unaffected
  • affected from 0 to 5.1 (excl.)
Vendor PHP Jabbers
Product Restaurant Booking System
Versions Default: unaffected
  • affected from 0 to 4.1 (excl.)
Vendor PHP Jabbers
Product Shuttle Booking Software
Versions Default: unaffected
  • affected from 0 to 3.1 (excl.)
Vendor PHP Jabbers
Product Meeting Room Booking System
Versions Default: unaffected
  • affected from 0 to 2.1 (excl.)
Vendor PHP Jabbers
Product Rental Property Booking Calendar
Versions Default: unaffected
  • affected from 0 to 3.1 (excl.)
Vendor PHP Jabbers
Product Service Booking Script
Versions Default: unaffected
  • affected from 0 to 2.1 (excl.)
Vendor PHP Jabbers
Product Limo Booking Software
Versions Default: unaffected
  • affected from 0 to 2.1 (excl.)
Vendor PHP Jabbers
Product Taxi Booking Script
Versions Default: unaffected
  • affected from 0 to 3.1 (excl.)
Vendor PHP Jabbers
Product Job Listing Script
Versions Default: unaffected
  • affected from 0 to 4.1 (excl.)
Vendor PHP Jabbers
Product Property Listing Script
Versions Default: unaffected
  • affected from 0 to 4.1 (excl.)
Vendor PHP Jabbers
Product Travel Tours Script
Versions Default: unaffected
  • affected from 0 to 3.1 (excl.)
Vendor PHP Jabbers
Product Vacation Rental Script
Versions Default: unaffected
  • affected from 0 to 5.1 (excl.)
Vendor PHP Jabbers
Product Yacht Listing Script
Versions Default: unaffected
  • affected from 0 to 3.1 (excl.)

Credits

  • Kamil Szczurowski finder
  • Robert Kruczek finder

References

Problem Types

  • CWE-352 Cross-Site Request Forgery (CSRF) CWE

Impacts

  • CAPEC-62 Cross Site Request Forgery