Security readout for executives and security teams
Plain-English summary
Multiple PHP Jabbers web scripts can let an attacker trick a signed-in administrator into unknowingly authorizing sensitive actions. The reported impact includes creation of new administrator accounts, potentially enabling persistent unauthorized control. The issue depends on user interaction and an active authenticated session.
Executive priority
Treat this as a prompt remediation item for internet-facing or business-critical PHP Jabbers deployments. Prioritize systems with frequently used administrative sessions because compromise could create persistent privileged access. Escalate immediately if unexplained administrator accounts or sensitive configuration changes are discovered.
Technical view
CVE-2025-67651 is a CWE-352 cross-site request forgery vulnerability caused by missing CSRF tokens or appropriate SameSite cookie attributes. It has CVSS 4.0 score 6.9 and high integrity impact, with no reported confidentiality or availability impact. The supplied version data does not clearly identify vulnerable or fixed releases.
Likely exposure
Exposure is limited to organizations operating the named PHP Jabbers scripts where administrators authenticate through a browser. Exact exposure cannot be determined from the supplied affected-product entries because they show version "0" with default status "unaffected" and identify no usable vulnerable-version ranges.
Exploitation context
Successful exploitation requires an authenticated user to interact with attacker-controlled content while their application session remains valid. Unauthorized administrative actions may then execute under that user's authority. The CVE is not listed in KEV, and the supplied sources provide no evidence of active exploitation.
Researcher notes
The CVSS vector indicates network reachability, low complexity, no attacker privileges, required user interaction, and high vulnerable-system integrity impact. Product breadth is reported, but precise version applicability is unresolved. The CERT Polska reference path names CVE-2025-67649, so analysts should verify whether that advisory intentionally covers this CVE.
Mitigation direction
- Identify deployed PHP Jabbers products and their exact installed versions.
- Obtain confirmed fixed-version guidance directly from PHP Jabbers or the cited advisory.
- Upgrade affected installations to vendor-confirmed fixed releases.
- Verify updates implement CSRF protection and appropriate SameSite session-cookie settings.
- Restrict administrative interfaces while version status remains unresolved.
Validation and detection
- Inventory every named PHP Jabbers script exposed internally or publicly.
- Compare installed versions against current vendor-confirmed affected and fixed ranges.
- Inspect administrative requests for server-validated anti-CSRF tokens in authorized testing.
- Check session cookies for appropriate SameSite attributes.
- Review administrator accounts and audit records for unexplained privileged changes.
Public sources used
Generated from the cited source records. This long-tail analysis has not been individually reviewed by a named human.
Conservative CVE-to-ATT&CK context
These mappings and lookup hints may be relevant to the vulnerability behavior, CWE, affected product, or exposure path. Glexia-inferred context is not an official MITRE, ATT&CK, CWE, or CVE Program mapping.
ATT&CK lookup starting points
Use these exact CWE pages and searches to review the Glexia ATT&CK library from this CVE's weakness and description context.
CWE-352: User-session and phishing behavior lookup
Client-side and session-facing weaknesses should be reviewed alongside initial-access and user-execution behaviors. Open the exact CWE lookup page first, then review the ATT&CK searches from that MITRE weakness context. This is a Glexia lookup hint, not an official ATT&CK mapping.
Open ATT&CK lookupCVE-2025-67651 mapping review
Open the CVE-to-ATT&CK bridge for reviewed, inferred, or future official mappings tied to this CVE.
Open ATT&CK lookup- Severity
- Medium
- CVSS
- 6.9 (4.0)
- Known Exploited
- No
- Published
Vector: CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:A/VC:N/VI:H/VA:N/SC:N/SI:N/SA:N
CNA and ADP enrichment extracted from CVE v5
These fields come from the CVE record and ADP containers, not from Glexia's Take. They preserve time-varying source decisions such as CISA SSVC, KEV status, CVSS metrics, and provider references.
SSVC decision data
CVSS vector scores
1 official scoreWe collect every scored CVSS vector available in the official CNA and ADP containers. When more than one version is present, the table keeps the source vectors side by side instead of collapsing them into the highest score.
CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:A/VC:N/VI:H/VA:N/SC:N/SI:N/SA:N——CERT-PLVulnerability scoring details
Base CVSS 4.0 score
6.9MediumVector: CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:A/VC:N/VI:H/VA:N/SC:N/SI:N/SA:N
Vulnerability timeline
Timeline events are normalized from CVE metadata, CNA source timelines, ADP timelines, and KEV metadata when present.
- CVE reservedCVE Program
The CVE ID was reserved by the assigning CNA.
- CVE publishedCVE Program
The CVE record was published.
- CVE updatedCVE Program
The CVE record metadata indicates this as the latest update time.
ADP provider summaries
Source materials
- CVE List V5 sourceCVE List V5
- https://cert.pl/en/posts/2026/07/CVE-2025-67649/CVE reference, CERT-PL · third-party-advisory
- https://www.phpjabbers.com/CVE reference, CERT-PL · product
Products and packages named in the record
CWE details
CWE links open Glexia weakness intelligence pages with official CWE context, developer remediation guidance, and related CVE mappings.
Cross-Site Request Forgery (CSRF)
Cross-Site Request Forgery (CSRF) represents a recurring weakness pattern that can create exploitable paths when design, validation, or implementation controls are missing.