Unauthenticated SQL data disclosure via unparameterized busid query
Published Jun 18, 2026 · Updated Jun 18, 2026
SQL injection in Nur-Alam39 Bus Ticket at commit 459cabdb allows remote attackers to read database data through an HTTP POST request. In bus_info.php, the busid value is interpolated unquoted into a SELECT query and passed to mysqli_query without validation or parameterization. No authentication or user interaction is required; UNION-based input exposes arbitrary data readable by the MySQL root connection, while stacked statements are unavailable.
Summary
What happened
SQL injection in Nur-Alam39 Bus Ticket at commit 459cabdb allows remote attackers to read database data through an HTTP POST request. In bus_info.php, the busid value is interpolated unquoted into a SELECT query and passed to mysqli_query without validation or parameterization. No authentication or user interaction is required; UNION-based input exposes arbitrary data readable by the MySQL root connection, while stacked statements are unavailable.
The record
- CVE
- CVE-2026-55740
- Published
- Jun 18, 2026
- Updated
- Jun 18, 2026
- Vendor
- Nur-Alam39
- Product
- Bus Ticket
- Classifications
- CWE-89, T1190
- Attack vector
- network
- Privileges
- unauthenticated
Timeline
How it unfolded
- Jun 18, 2026CVE publishedPublication date reported by the CVE source.
- Jun 18, 2026Record updatedLatest update available in the CVE record.
Exploitability
Present is not the same as exploitable
Compare your product and version with the public record. A matching version still requires validation against your environment.
Is a vulnerable build present?
Affected versions are unavailable in this record. Check the vendor advisory for version and patch details.
What conditions does exploitation require?
What is affected?
Attacks
What attackers are doing with it
Daily unique IPs observed by Shadowserver honeypots for known exploited vulnerabilities (KEVs). Missing observations do not establish an absence of attacks.
Weakness, pattern, technique
Public exploit references
No public exploit references are available in this record.
Labels summarize the accepted research assessment. They do not indicate a test against your environment.
Technologies
Your stack
See the directory against your own environment.
Your stack
Check the software in your environment
Book a demo to see how Hinoki identifies affected software and validates exploitability in your environment.
Book a demo