CVE-2025-67651 Overview
CVE-2025-67651 is a Cross-Site Request Forgery (CSRF) vulnerability affecting multiple PHP Jabbers scripts. The affected applications do not implement CSRF tokens and do not set appropriate SameSite cookie attributes. Attackers can craft malicious web pages that send unauthorized requests in the context of an authenticated administrator. Successful exploitation allows attackers to perform privileged actions, including creating new administrator accounts. The vendor addressed the issue in updated versions listed in the affected products advisory. The vulnerability is tracked under CWE-352.
Critical Impact
Attackers can create unauthorized administrator accounts by tricking authenticated admins into visiting a malicious page, resulting in full application compromise.
Affected Products
- Multiple PHP Jabbers scripts (specific product list published by the vendor)
- Refer to the PHPJabbers Security Blog for the full affected-versions list
- Fixed versions specified in the vendor advisory
Discovery Timeline
- 2026-07-31 - CVE-2025-67651 published to the National Vulnerability Database
- 2026-07-31 - Last updated in NVD database
Technical Details for CVE-2025-67651
Vulnerability Analysis
The vulnerability stems from missing anti-CSRF controls in administrative endpoints across multiple PHP Jabbers scripts. State-changing HTTP requests do not require a unique, unpredictable token bound to the user session. Session cookies are also configured without a restrictive SameSite attribute, allowing them to be sent on cross-site requests. An attacker who lures an authenticated administrator to a malicious page can trigger arbitrary administrative actions using the victim's session. The most notable abuse path is the creation of new administrator accounts, which grants the attacker persistent, privileged access. Since the exploitation happens through the victim's browser, the attacker never needs valid credentials or direct network access to the admin panel.
Root Cause
The root cause is the absence of two complementary defenses. First, the affected scripts do not generate or validate per-request CSRF tokens on state-changing endpoints. Second, session cookies lack SameSite=Lax or SameSite=Strict attributes, so browsers attach them to cross-origin form submissions. Together, these gaps allow forged requests to be treated as authentic by the application.
Attack Vector
Exploitation is network-based and requires user interaction. An attacker hosts a page containing an auto-submitting HTML form or an image tag pointing at a vulnerable administrative endpoint. When an authenticated administrator visits the attacker-controlled page, the browser attaches the valid session cookie and issues the forged request. The vulnerable script executes the action, such as inserting a new admin user, without additional verification. No authentication bypass is required because the request rides on the victim's existing session.
No verified public exploit code is available. See the CERT Poland advisory for coordinated disclosure details covering the PHP Jabbers CSRF issues.
Detection Methods for CVE-2025-67651
Indicators of Compromise
- Unexpected administrator accounts appearing in the application user table, particularly with generic usernames or non-corporate email addresses
- Administrative POST requests where the HTTP Referer or Origin header points to an external, untrusted domain
- Access log entries showing sensitive admin endpoints being called immediately after the administrator visited an unrelated third-party site
Detection Strategies
- Review web server access logs for state-changing requests to admin endpoints that lack a same-origin Referer header
- Audit the application database for administrator accounts created outside change-control windows
- Correlate browser telemetry with server-side admin actions to identify requests triggered by cross-site navigation
Monitoring Recommendations
- Alert on any creation, modification, or privilege change of administrator accounts in PHP Jabbers applications
- Monitor for HTTP requests to admin URLs missing expected CSRF token parameters
- Track outbound browsing activity from privileged user workstations to reduce exposure to attacker-controlled pages
How to Mitigate CVE-2025-67651
Immediate Actions Required
- Upgrade every affected PHP Jabbers script to the fixed version listed in the vendor advisory on the PHPJabbers site
- Audit administrator accounts and remove any that cannot be attributed to a legitimate change request
- Force a password reset and session invalidation for all administrative users after patching
Patch Information
PHP Jabbers has released fixed versions for the affected scripts. Administrators should consult the vendor advisory and the CERT Poland coordinated disclosure post for the mapping between each script and its patched release. Apply the fixed release for every deployed PHP Jabbers product, not only the one where suspicious activity was observed.
Workarounds
- Configure the web server or application to set SameSite=Lax or SameSite=Strict on session cookies until patching is complete
- Restrict access to admin panels using IP allow-listing or VPN-only access to reduce cross-site exposure
- Instruct administrators to use a dedicated browser profile for managing PHP Jabbers applications and to log out immediately after use
# Example: enforce SameSite and Secure attributes on PHP session cookies
# php.ini
session.cookie_samesite = "Strict"
session.cookie_secure = 1
session.cookie_httponly = 1
Disclaimer: This content was generated using AI. While we strive for accuracy, please verify critical information with official sources.
