Is CVE-2025-67649 exploited in the wild?

No. Junglewise Threat Intelligence has no report of CVE-2025-67649 being exploited in the wild.

How severe is CVE-2025-67649?

Informational severity, with a CVSS score of 9.3, published 31 July 2026.

Which products and versions are affected?

PHP Jabbers Car Rental Script All versions before 4.1.

Is there a fix for CVE-2025-67649?

A patch was published on 2026-06-01: Version 4.1 released with security fixes Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.

How is CVE-2025-67649 attacked?

It is attacked over the network, in a web application.

Am I affected by CVE-2025-67649?

Check whether you run PHP Jabbers Car Rental Script at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

CVE-2025-67649: PHP Jabbers Car Rental Script SQL injection in sorting functions

CVE-2025-67649 · Severity: info · CVSS 9.3 · Published 2026-07-31

PHP Jabbers Car Rental Script, a web-based booking system for rental businesses, contains a critical security flaw. An attacker can exploit this vulnerability to gain unauthorized access to the underlying database, potentially leading to the theft of customer information, reservation data, and administrative credentials. This could result in significant data breaches and operational disruption for car rental companies using the software.

Technologies: PHP Jabbers Car Rental Script. Vendors: PHP Jabbers.

Quick answers

Is CVE-2025-67649 exploited in the wild?: No. Junglewise Threat Intelligence has no report of CVE-2025-67649 being exploited in the wild.
How severe is CVE-2025-67649?: Informational severity, with a CVSS score of 9.3, published 31 July 2026.
Which products and versions are affected?: PHP Jabbers Car Rental Script All versions before 4.1.
Is there a fix for CVE-2025-67649?: A patch was published on 2026-06-01: Version 4.1 released with security fixes Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.
How is CVE-2025-67649 attacked?: It is attacked over the network, in a web application.
Am I affected by CVE-2025-67649?: Check whether you run PHP Jabbers Car Rental Script at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

Technical details

A SQL injection vulnerability exists in PHP Jabbers Car Rental Script due to improper neutralization of user-supplied input in parameters used for sorting functions. An unauthenticated remote attacker can exploit this by sending specially crafted web requests to the application. Successful exploitation allows the attacker to read, modify, or delete data within the database, potentially leading to full system compromise. The issue is addressed in version 4.1, which includes security hardening and CSRF protection.

Affected products

PHP Jabbers Car Rental Script All versions before 4.1

Timeline

2026-07-31: disclosed: Advisory published by CERT Polska
2026-06-01: patched: Version 4.1 released with security fixes

References

This page as Markdown. Free to reuse under CC BY 4.0 with a link back.