Executive brief
PHP Jabbers PHP Poll Script, a tool used to create and manage online voting and surveys, contains a security vulnerability in its administrative interface. An attacker with administrative credentials can inject malicious database commands, potentially allowing them to view, modify, or delete sensitive data stored in the application's database. This could lead to a complete compromise of the polling data and the underlying database server.
Technical details
A SQL injection vulnerability exists in the PHP Jabbers PHP Poll Script due to improper neutralization of user-supplied input within the pjAdminPolls.controller.php endpoint. The flaw allows an authenticated attacker with high privileges (administrative access) to submit specially crafted input that alters the intended SQL queries. Successful exploitation can lead to unauthorized data disclosure, modification, or deletion within the database. The vulnerability is addressed in version 4.1 of the script.
Affected products
- PHP Jabbers PHP Poll Script All versions before 4.1
Timeline
- 2026-07-31: advisory: Initial disclosure by CERT Polska and NVD publication.
- 2026-07-31: patched: Fixed in version 4.1.