ورود / ثبت‌نام

جزئیات آسیب‌پذیری

CVE-2025-67650

PHP Jabbers Appointment SchedulerPHP Jabbers Auto Classifieds ScriptPHP Jabbers Availability Booking CalendarPHP Jabbers Availability CalendarPHP Jabbers Bus Reservation SystemPHP Jabbers Business Directory Script

Authenticated SQL Injection in PHP Jabbers scripts

CVSS 4.0
8.6بالا

شرح رسمی (انگلیسی)

An authenticated SQL injection vulnerability has been identified in multiple PHP Jabbers scripts. Improper neutralization of input provided by an authenticated user into parameters responsible for sorting functions allows an attacker to perform SQL Injection attacks. This issue was fixed in the versions specified in the affected products list.

امتیازهای CVSS

امتیازنسخهمنبعبردار
8.6بالا 4.0 CVEProject cvelistV5 (CNA) (CERT-PL) CVSS:4.0/AV:N/AC:L/AT:N/PR:H/UI:N/VC:H/VI:H/VA:L/SC:N/SI:N/SA:N

محصولات آسیب‌پذیر

فروشندهمحصولنسخه‌هامنبع
PHP Jabbers Appointment Scheduler v < 4.1 CVEProject cvelistV5 (CNA)
PHP Jabbers Auto Classifieds Script v < 4.1 CVEProject cvelistV5 (CNA)
PHP Jabbers Availability Booking Calendar v < 6.1 CVEProject cvelistV5 (CNA)
PHP Jabbers Availability Calendar v < 6.1 CVEProject cvelistV5 (CNA)
PHP Jabbers Bus Reservation System v < 2.1 CVEProject cvelistV5 (CNA)
PHP Jabbers Business Directory Script v < 4.1 CVEProject cvelistV5 (CNA)
PHP Jabbers Car Park Booking System v < 4.1 CVEProject cvelistV5 (CNA)
PHP Jabbers Car Rental Script v < 4.1 CVEProject cvelistV5 (CNA)
PHP Jabbers Cinema Booking System v < 2.1 CVEProject cvelistV5 (CNA)
PHP Jabbers Cleaning Business Software v < 2.1 CVEProject cvelistV5 (CNA)
PHP Jabbers Equipment Rental Script v < 2.1 CVEProject cvelistV5 (CNA)
PHP Jabbers Event Booking Calendar v < 5.1 CVEProject cvelistV5 (CNA)
PHP Jabbers Event Ticketing System v < 2.1 CVEProject cvelistV5 (CNA)
PHP Jabbers Food Delivery Script v < 4.1 CVEProject cvelistV5 (CNA)
PHP Jabbers Hotel Booking System v < 5.1 CVEProject cvelistV5 (CNA)
PHP Jabbers Job Listing Script v < 4.1 CVEProject cvelistV5 (CNA)
PHP Jabbers Limo Booking Software v < 2.1 CVEProject cvelistV5 (CNA)
PHP Jabbers Meeting Room Booking System v < 2.1 CVEProject cvelistV5 (CNA)
PHP Jabbers Member Directory Script v < 2.1 CVEProject cvelistV5 (CNA)
PHP Jabbers Member Login Script v < 4.1 CVEProject cvelistV5 (CNA)
PHP Jabbers PHP Event Calendar v < 4.1 CVEProject cvelistV5 (CNA)
PHP Jabbers PHP Newsletter Script v < 5.1 CVEProject cvelistV5 (CNA)
PHP Jabbers PHP Shopping Cart v < 6.0 CVEProject cvelistV5 (CNA)
PHP Jabbers Product Comparison Script v < 2.1 CVEProject cvelistV5 (CNA)
PHP Jabbers Property Listing Script v < 4.1 CVEProject cvelistV5 (CNA)
PHP Jabbers Rental Property Booking Calendar v < 3.1 CVEProject cvelistV5 (CNA)
PHP Jabbers Restaurant Booking System v < 4.1 CVEProject cvelistV5 (CNA)
PHP Jabbers Service Booking Script v < 2.1 CVEProject cvelistV5 (CNA)
PHP Jabbers Shuttle Booking Software v < 3.1 CVEProject cvelistV5 (CNA)
PHP Jabbers Taxi Booking Script v < 3.1 CVEProject cvelistV5 (CNA)
PHP Jabbers Ticket Support Script v < 4.1 CVEProject cvelistV5 (CNA)
PHP Jabbers Time Slots Booking Calendar v < 5.1 CVEProject cvelistV5 (CNA)
PHP Jabbers Travel Tours Script v < 3.1 CVEProject cvelistV5 (CNA)
PHP Jabbers Vacation Rental Script v < 5.1 CVEProject cvelistV5 (CNA)
PHP Jabbers Yacht Listing Script v < 3.1 CVEProject cvelistV5 (CNA)

منابع و راهنماها

۲
هشدار CVEهای بعدی این محصولمحصول را دنبال کنید تا آسیب‌پذیری‌های تازه را در تلگرام بگیرید.

اطلاعات

تاریخ انتشار
۱۴۰۵/۰۵/۰۹
آخرین به‌روزرسانی
۱۴۰۵/۰۵/۰۹
وضعیت
منتشرشده
صادرکننده (CNA)
CERT-PL

پیش‌بینی بهره‌برداری (EPSS)

۰٫۳۸٪
احتمال بهره‌برداری در ۳۰ روز
۳۲٫۵٪
صدک (نسبت به همه‌ی CVEها)

ارزیابی SSVC (CISA)

قابل خودکارسازی
خیر
وضعیت بهره‌برداری
ندارد
اثر فنی
کامل

ضعف‌ها (CWE)

  • CWE-89
    Improper neutralization of special elements used in an SQL command ('SQL injection')