An authenticated SQL injection vulnerability (CWE-89) exists in PHP Jabbers Appointment Scheduler due to improper neutralization of special elements in SQL commands. Authenticated users can manipulate input parameters responsible for sorting functions, leading to potential SQL injection attacks. The vulnerability is rated high severity with a CVSS 4.0 score of 8.6, indicating network attack vector, low attack complexity, no user interaction, and high impact on confidentiality, integrity, and availability. No explicit patch or remediation details are provided in the available data.

Successful exploitation allows an authenticated attacker to perform SQL injection attacks, potentially leading to unauthorized data access, data modification, or disruption of service within the affected PHP Jabbers Appointment Scheduler scripts. The high CVSS score reflects significant impact on confidentiality, integrity, and availability of the system.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. The description notes that the issue was fixed in certain versions, but no specific patch links or fixed versions are provided. Users should consult PHP Jabbers official advisories to identify and apply the appropriate updates. Until patched, restrict authenticated user privileges to minimize risk.