Description (CNA)
Nur-Alam39 bus-ticket (no released versions; latest commit 459cabdbeb99c00225b26e46e3c2c30ae1de7bad) contains an unauthenticated SQL injection vulnerability in bus_info.php. The busid parameter received via HTTP POST is concatenated directly into a MySQL query (select * from bus_info where id=) without sanitization, escaping, or parameterization, and in a numeric (unquoted) context.
Affected (CNA)
| Vendor / product | Versions |
|---|---|
| Nur-Alam39 / bus-ticket | affected 0 |
CWE
CWE-89
References
- https://github.com/Nur-Alam39/bus-ticket/blob/459cabdbeb99c00225b26e46e3c2c30ae1de7bad/bus_info.php#L14-L16
- https://github.com/Nur-Alam39/bus-ticket
ADP enrichment
No English description supplied.
No references supplied.