CVE-2025-67651
Received Received - Intake

Cross-Site Request Forgery in PHP Jabbers Scripts

Publication date: 2026-07-31

Last updated on: 2026-07-31

Assigner: CERT.PL

Description
A Cross-Site Request Forgery (CSRF) vulnerability has been identified in multiple PHP Jabbers scripts. The lack of CSRF tokens or appropriate SameSite attributes allows an attacker to send unauthorized requests in the context of an authenticated user, leading to unauthorized administrative actions, such as creating new admin accounts. This issue was fixed in the versions specified in the affected products list.

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published
2026-07-31
Last Modified
2026-07-31
Generated
2026-07-31
AI Q&A
2026-07-31
EPSS Evaluated
N/A
NVD
CVE-2025-67651
EUVD
EUVD-2025-210568

Affected Vendors & Products

Currently, no data is known.

Helpful Resources

Exploitability

CWE
CWE Icon
KEV
KEV Icon
CWE ID Description
CWE-352 The web application does not, or cannot, sufficiently verify whether a request was intentionally provided by the user who sent the request, which could have originated from an unauthorized actor.

Attack-Flow Graph

AI Quick Actions

Instant insights powered by AI
Executive Summary

This is a Cross-Site Request Forgery (CSRF) vulnerability in multiple PHP Jabbers scripts. It occurs because the software lacks CSRF tokens or SameSite attributes, allowing attackers to trick authenticated users into sending unauthorized requests. This can lead to actions like creating new admin accounts without proper authorization.

Detection Guidance

Detecting CSRF vulnerabilities typically involves checking for missing CSRF tokens or SameSite cookie attributes in web applications. Inspect network traffic for POST requests without anti-CSRF tokens, review application code for proper session validation, and test with tools like OWASP ZAP or Burp Suite to identify unprotected endpoints.

Impact Analysis

An attacker could exploit this to perform unauthorized actions on your behalf, such as creating admin accounts, modifying settings, or accessing sensitive data. This could lead to full system compromise if the attacker gains administrative control.

Compliance Impact

This vulnerability could lead to unauthorized access or data breaches, violating GDPR's integrity and confidentiality requirements or HIPAA's safeguards for protected health information. Non-compliance may result in legal penalties or fines.

Mitigation Strategies

Update affected PHP Jabbers scripts to the fixed versions specified by the vendor to address the CSRF vulnerability. Ensure CSRF tokens are implemented in all forms and SameSite attributes are properly set for cookies to prevent unauthorized requests.

Chat Assistant

Ask questions about this CVE
Hi! I’m here to help you understand CVE-2025-67651. Ask me anything about the vulnerability, its impact, or mitigation strategies.
0/70

EPSS Chart