SQL Injection Vulnerability in PHP Jabbers Car Rental Script
CVE-2025-67649

9.3CRITICAL

Key Information:

Vendor

PHP Jabbers

Status
Car Rental Script
Vendor
CVE Published:
31 July 2026

What is CVE-2025-67649?

A SQL injection flaw has been discovered in the Car Rental Script by PHP Jabbers, stemming from inadequate sanitization of user input in sorting function parameters. This vulnerability enables unauthenticated attackers to manipulate database queries, potentially leading to unauthorized access to sensitive data. The issue has been addressed in version 4.1 of the product.

Affected Version(s)

Car Rental Script 0 < 4.1

References

https://cert.pl/en/posts/2026/07/CVE-2025-67649/
third-party-advisory
https://www.phpjabbers.com/car-rental-script/
product

CVSS V4

Score:
9.3
Severity:
CRITICAL
Confidentiality:
High
Integrity:
High
Availability:
Low
Attack Vector:
Network
Attack Complexity:
Low
Attack Required:
None
Privileges Required:
Undefined
User Interaction:
None

Timeline

  • Vulnerability published

  • Vulnerability Reserved

Credit

Kamil Szczurowski
Robert Kruczek
.