Executive brief
A security vulnerability has been identified in over 30 different PHP Jabbers web scripts, which are used to provide booking, e-commerce, and directory features for websites. An attacker could trick a logged-in administrator into performing unintended actions, such as creating new unauthorized admin accounts. This could lead to a full takeover of the affected website's management system. Users should update their scripts to the latest versions to prevent this unauthorized access.
Technical details
A Cross-Site Request Forgery (CSRF) vulnerability exists in multiple PHP Jabbers scripts due to the absence of anti-CSRF tokens and appropriate SameSite cookie attributes. An unauthenticated attacker can exploit this by inducing an authenticated administrative user to visit a malicious website or click a specially crafted link. If successful, the attacker can execute unauthorized requests in the context of the victim's session, such as creating new administrative accounts or modifying system configurations. The vulnerability affects a wide range of products including Appointment Scheduler, Car Rental Script, and Hotel Booking System. Patches have been released for all affected products, with fixed versions ranging from 2.1 to 6.1 depending on the specific script.
Affected products
- PHP Jabbers Appointment Scheduler Before 4.1
- PHP Jabbers Bus Reservation System Before 2.1
- PHP Jabbers Car Park Booking System Before 4.1
- PHP Jabbers Car Rental Script Before 4.1
- PHP Jabbers Cinema Booking System Before 2.1
- PHP Jabbers Event Booking Calendar Before 5.1
- PHP Jabbers Event Ticketing System Before 2.1
- PHP Jabbers Hotel Booking System Before 5.1
- PHP Jabbers Cleaning Business Software Before 2.1
- PHP Jabbers Equipment Rental Script Before 2.1
- PHP Jabbers Food Delivery Script Before 4.1
- PHP Jabbers Member Login Script Before 4.1
- PHP Jabbers Member Directory Script Before 2.1
- PHP Jabbers Availability Calendar Before 6.1
- PHP Jabbers PHP Event Calendar Before 4.1
- PHP Jabbers PHP Newsletter Script Before 5.1
- PHP Jabbers Product Comparison Script Before 2.1
- PHP Jabbers Ticket Support Script Before 4.1
- PHP Jabbers PHP Shopping Cart Before 6.0
- PHP Jabbers Auto Classifieds Script Before 4.1
- PHP Jabbers Business Directory Script Before 4.1
- PHP Jabbers, Availability Booking Calendar Before 6.1
- PHP Jabbers Time Slots Booking Calendar Before 5.1
- PHP Jabbers Restaurant Booking System Before 4.1
- PHP Jabbers Shuttle Booking Software Before 3.1
- PHP Jabbers Meeting Room Booking System Before 2.1
- PHP Jabbers Rental Property Booking Calendar Before 3.1
- PHP Jabbers Service Booking Script Before 2.1
- PHP Jabbers Limo Booking Software Before 2.1
- PHP Jabbers Taxi Booking Script Before 3.1
- PHP Jabbers Job Listing Script Before 4.1
- PHP Jabbers Property Listing Script Before 4.1
- PHP Jabbers Travel Tours Script Before 3.1
- PHP Jabbers Vacation Rental Script Before 5.1
- PHP Jabbers Yacht Listing Script Before 3.1
Timeline
- 2026-07-31: disclosed
- 2026-07-31: patched
- 2026-07-31: advisory