CVE-2025-67651

Deferred Deferred - Pending Action

BaseFortify

Publication date: 2026-07-31

Last updated on: 2026-09-29

Assigner: CERT.PL

Description

A Cross-Site Request Forgery (CSRF) vulnerability has been identified in multiple PHP Jabbers scripts. The lack of CSRF tokens or appropriate SameSite attributes allows an attacker to send unauthorized requests in the context of an authenticated user, leading to unauthorized administrative actions, such as creating new admin accounts. This issue was fixed in the versions specified in the affected products list.

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published

2026-07-31

Last Modified

2026-09-29

Generated

2026-10-19

AI Q&A

2026-07-31

EPSS Evaluated

2026-10-18

NVD

CVE-2025-67651

EUVD

EUVD-2025-210568

Affected Vendors & Products

Vendor	Product	Version / Range
PHP	Jabbers	Appointment Scheduler 0
PHP	Jabbers	Bus Reservation System 0
PHP	Jabbers	Car Park Booking System 0
PHP	Jabbers	Car Rental Script 0
PHP	Jabbers	Cinema Booking System 0
PHP	Jabbers	Event Booking Calendar 0
PHP	Jabbers	Event Ticketing System 0
PHP	Jabbers	Hotel Booking System 0
PHP	Jabbers	Cleaning Business Software 0
PHP	Jabbers	Equipment Rental Script 0
PHP	Jabbers	Food Delivery Script 0
PHP	Jabbers	Member Login Script 0
PHP	Jabbers	Member Directory Script 0
PHP	Jabbers	Availability Calendar 0
PHP	Jabbers	PHP Event Calendar 0
PHP	Jabbers	PHP Newsletter Script 0
PHP	Jabbers	Product Comparison Script 0
PHP	Jabbers	Ticket Support Script 0
PHP	Jabbers	PHP Shopping Cart 0
PHP	Jabbers	Auto Classifieds Script 0
PHP	Jabbers	Business Directory Script 0
PHP	Jabbers	Availability Booking Calendar 0
PHP	Jabbers	Time Slots Booking Calendar 0
PHP	Jabbers	Restaurant Booking System 0
PHP	Jabbers	Shuttle Booking Software 0
PHP	Jabbers	Meeting Room Booking System 0
PHP	Jabbers	Rental Property Booking Calendar 0
PHP	Jabbers	Service Booking Script 0
PHP	Jabbers	Limo Booking Software 0
PHP	Jabbers	Taxi Booking Script 0
PHP	Jabbers	Job Listing Script 0
PHP	Jabbers	Property Listing Script 0
PHP	Jabbers	Travel Tours Script 0
PHP	Jabbers	Vacation Rental Script 0
PHP	Jabbers	Yacht Listing Script 0

Helpful Resources

Exploitability

CWE

KEV

CWE ID	Description
CWE-352	The web application does not, or cannot, sufficiently verify whether a request was intentionally provided by the user who sent the request, which could have originated from an unauthorized actor.

Attack-Flow Graph

Executive Summary

This is a Cross-Site Request Forgery (CSRF) vulnerability in multiple PHP Jabbers scripts. It occurs because the software lacks CSRF tokens or SameSite attributes, allowing attackers to trick authenticated users into sending unauthorized requests. This can lead to actions like creating new admin accounts without proper authorization.

Detection Guidance

Detecting CSRF vulnerabilities typically involves checking for missing CSRF tokens or SameSite cookie attributes in web applications. Inspect network traffic for POST requests without anti-CSRF tokens, review application code for proper session validation, and test with tools like OWASP ZAP or Burp Suite to identify unprotected endpoints.

Impact Analysis

An attacker could exploit this to perform unauthorized actions on your behalf, such as creating admin accounts, modifying settings, or accessing sensitive data. This could lead to full system compromise if the attacker gains administrative control.

Compliance Impact

This vulnerability could lead to unauthorized access or data breaches, violating GDPR's integrity and confidentiality requirements or HIPAA's safeguards for protected health information. Non-compliance may result in legal penalties or fines.

Mitigation Strategies

Update affected PHP Jabbers scripts to the fixed versions specified by the vendor to address the CSRF vulnerability. Ensure CSRF tokens are implemented in all forms and SameSite attributes are properly set for cookies to prevent unauthorized requests.

Hi! I’m here to help you understand CVE-2025-67651. Ask me anything about the vulnerability, its impact, or mitigation strategies.

0/70