Unauthenticated SQL Injection in Bus Ticket Application by Nur-Alam39
CVE-2026-55740

9.3CRITICAL

Key Information:

Vendor

Nur-alam39

Status
Bus-ticket
Vendor
CVE Published:
18 June 2026

What is CVE-2026-55740?

The bus ticket application by Nur-Alam39 contains a serious unauthenticated SQL injection vulnerability located in bus_info.php. This occurs when the busid parameter from an HTTP POST request is directly concatenated into a MySQL query without any form of sanitization, escaping, or parameterization. This vulnerability allows a remote attacker to inject arbitrary SQL code, potentially exposing sensitive information from the bus_service database. The application utilizes the MySQL root account with an empty password, significantly increasing the risk of data compromise. The flawed query execution method, using mysqli_query(), does not allow for stacked queries, but the lack of proper sanitization remains a critical flaw.

References

https://github.com/Nur-Alam39/bus-ticket/blob/459cabdbeb9...
technical-description
https://github.com/Nur-Alam39/bus-ticket
product

CVSS V4

Score:
9.3
Severity:
CRITICAL
Confidentiality:
High
Integrity:
High
Availability:
High
Attack Vector:
Network
Attack Complexity:
Low
Attack Required:
None
Privileges Required:
Undefined
User Interaction:
None

Timeline

  • Vulnerability published

  • Vulnerability Reserved

Credit

Eshmurzayev Abbos
.