CVE-2025-67649: Car Rental Script SQLi Vulnerability

CVE-2025-67649 Overview

CVE-2025-67649 is a SQL injection vulnerability in PHP Jabbers Car Rental Script. The flaw exists in parameters that handle sorting functions, where user-supplied input is passed to database queries without proper neutralization. An unauthenticated remote attacker can inject arbitrary SQL statements through these parameters. The issue is tracked under CWE-89 (Improper Neutralization of Special Elements used in an SQL Command). PHP Jabbers addressed the issue in version 4.1. CERT Poland coordinated disclosure and published details in the CERT Poland advisory.

Critical Impact
Unauthenticated attackers can extract, modify, or delete database contents of the Car Rental Script, including customer bookings, credentials, and payment-adjacent data.

Affected Products

PHP Jabbers Car Rental Script versions prior to 4.1
Deployments exposing sortable list views to unauthenticated users
Instances integrated with shared backend databases hosting related PHP Jabbers products

Discovery Timeline

2026-07-31 - CVE CVE-2025-67649 published to NVD
2026-07-31 - Last updated in NVD database

Technical Details for CVE-2025-67649

Vulnerability Analysis

The Car Rental Script is a commercial PHP application for managing vehicle reservations, fleets, and customer accounts. The vulnerability resides in server-side handlers that accept sorting parameters, typically column names and sort direction, from HTTP requests. These values are concatenated into SQL queries without parameterization or allow-list validation.

Because the affected endpoints do not require authentication, any remote attacker with network access to the application can trigger the flaw. Successful exploitation compromises confidentiality and integrity of the underlying database and can be chained with file-read primitives depending on database privileges.

Root Cause

The root cause is improper neutralization of input used in the ORDER BY clause of dynamic SQL statements. Parameterized queries cannot bind identifiers such as column names, so developers frequently interpolate these values directly. Without an explicit allow-list of permitted sort columns, attackers submit crafted values that break out of the identifier context and append arbitrary SQL syntax.

Attack Vector

Exploitation requires only a network path to the vulnerable endpoint. An attacker issues an HTTP request to a listing page that supports sorting, modifying the sort parameter to include SQL payloads such as boolean conditions, UNION SELECT statements, or time-based blind constructs. The database engine executes the injected fragment, allowing the attacker to read arbitrary tables, exfiltrate credentials, or manipulate application state. See the CERT Poland advisory for coordinated disclosure details.

Detection Methods for CVE-2025-67649

Indicators of Compromise

HTTP requests to Car Rental Script endpoints containing SQL keywords such as UNION, SELECT, SLEEP, BENCHMARK, or INFORMATION_SCHEMA inside sort-related query parameters.
Web server access logs showing repeated requests to the same listing endpoint with varying order, sort, sort_by, or similar parameter values.
Database error messages returned in HTTP responses referencing MySQL syntax errors near ORDER BY clauses.

Detection Strategies

Deploy web application firewall (WAF) rules that block SQL metacharacters in sort parameters bound for PHP Jabbers endpoints.
Enable database query logging and alert on ORDER BY clauses containing subqueries, comments (--, #), or conditional expressions.
Correlate anomalous response sizes and latencies on listing pages, which indicate blind or time-based injection probing.

Monitoring Recommendations

Forward web server, WAF, and database logs to a centralized analytics platform for correlation across HTTP and SQL layers.
Baseline normal sort parameter values per endpoint and alert on deviations, including unexpected character classes.
Monitor for outbound connections from the web server to attacker-controlled infrastructure that may indicate post-exploitation data exfiltration.

How to Mitigate CVE-2025-67649

Immediate Actions Required

Upgrade PHP Jabbers Car Rental Script to version 4.1 or later, which contains the vendor fix.
Restrict public access to administrative and listing endpoints while patching is in progress, using IP allow-lists or authentication gateways.
Rotate database credentials and audit stored data for signs of tampering following the upgrade.

Patch Information

PHP Jabbers released Car Rental Script version 4.1 to remediate CVE-2025-67649. Administrators should obtain the update directly from PHP Jabbers and apply it to all affected instances. Verify installed version after deployment and re-run any custom themes or integrations against the patched release.

Workarounds

Place the application behind a WAF with rules that reject SQL syntax in order, sort, and related parameters until the patch is applied.
Enforce least-privilege database accounts so the application user cannot access unrelated schemas or execute file operations.
Disable or firewall off sort-enabled listing pages exposed to unauthenticated users where feasible.

bash

# Example WAF rule (ModSecurity) blocking SQL keywords in sort parameters
SecRule ARGS_NAMES "@rx ^(sort|order|order_by|sort_by)$" \
  "chain,id:1006749,phase:2,deny,status:403,msg:'Possible CVE-2025-67649 SQLi'"
  SecRule ARGS "@rx (?i)(union\s+select|sleep\(|benchmark\(|information_schema|--|#|/\*)" "t:none"