An authenticated SQL injection vulnerability in several PHP Jabbers scripts enables high-privileged attackers to compromise backend databases.

This is an SQL injection vulnerability (CWE-89) that requires the attacker to have administrative privileges. By injecting malicious SQL statements, an attacker can manipulate database queries.

While this vulnerability requires authentication, the potential for unauthorized data access or modification within the booking systems remains high. A CVSS score of 8.6 indicates a severe impact on the confidentiality and integrity of the data stored within these applications, which could disrupt business operations and lead to the exposure of sensitive client information.

Immediate Action: Update all affected PHP Jabbers software modules to the versions specified as fixed in the vendor security advisory.

Proactive Monitoring: Review application audit logs to identify any unusual administrative activities or unexpected database errors.

Compensating Controls: Restrict administrative access to these systems to a limited set of trusted internal IP addresses and implement strict input validation at the application layer.

Public Exploit Available: Unknown

Organizations using these PHP Jabbers scripts should verify their current versions against the list provided. It is imperative to perform the necessary updates to the specified fixed versions to ensure that administrative privileges cannot be abused to compromise the underlying database infrastructure.