CVE Intelligence
Analysis AI-assisted

CVE-2026-55740: Nur-Alam39 bus-ticket: Unauthenticated SQL Injection in bus_info.php

The Nur-Alam39 bus-ticket PHP project contains an unauthenticated SQL injection flaw in bus_info.php, where the busid POST parameter is concatenated into a MySQL query without sanitization or parameterization. The CNA rates it critical with a CVSS 3.1 score of 9.8. The project has no released versions and no fix is listed in the sources consulted.

Published Oct 13, 2026 · Updated Oct 13, 2026 · Ler em português

Overview

CVE-2026-55740 describes a SQL injection vulnerability (CWE-89) in bus-ticket, a small PHP/MySQL bus ticketing project published on GitHub by Nur-Alam39. In the file bus_info.php, the busid value submitted through HTTP POST is appended directly to a query against the bus_info table. No escaping, sanitization or prepared statement is used, and the value sits in a numeric, unquoted position, which means an attacker does not even need to break out of a string literal. The relevant code is visible in the referenced source lines.

Impact

The CNA assigned a CVSS 3.1 base score of 9.8 (Critical) with vector CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H, and also a CVSS 4.0 score of 9.3. The vector reflects network reachability, low complexity, and no authentication or user interaction. Successful exploitation could let a remote attacker read, modify or delete data in the application's database, such as passenger or booking records. Depending on database privileges and server configuration, broader impact on the hosting environment may be possible, though the sources do not detail this.

Affected products and versions

  • Product: Nur-Alam39 bus-ticket
  • Versions: the project has no formal releases; the record identifies the latest commit 459cabdbeb99c00225b26e46e3c2c30ae1de7bad as affected.
  • No structured affected-version ranges are provided in the record. Any deployment derived from this codebase should be presumed vulnerable unless the query has been rewritten.

Exploitation status

The vulnerability is not listed in the CISA Known Exploited Vulnerabilities catalog, and no confirmed exploitation appears in the sources consulted. No EPSS score is available. Because the flaw is trivial to identify in public source code and requires no authentication, opportunistic attempts against exposed instances are plausible.

Remediation and mitigation

No official fix or patched commit is listed in the record. Operators should consider:

  • Rewriting the query in bus_info.php to use prepared statements with bound parameters (for example via PDO or mysqli), and casting busid to an integer before use.
  • Reviewing the rest of the codebase for similar string-concatenated queries.
  • Running the application with a least-privilege database account that cannot alter schemas or access unrelated databases.
  • Restricting public exposure of the application, or placing it behind a web application firewall with SQL injection rules as a temporary control.
  • Treating this project as unmaintained code unsuitable for production unless it is independently reviewed and hardened.

Detection guidance

  • Review web server logs for POST requests to bus_info.php with non-numeric or unusually long busid values.
  • Monitor database logs for syntax errors, unexpected UNION queries, or time-delay functions originating from the application account.
  • Use WAF or IDS signatures for generic SQL injection patterns targeting this endpoint.
  • Check for unexpected changes to database content or new administrative records.

Limitations of the available information

The NVD record is in Deferred status, so NVD has not performed its own enrichment. There are no affected-version ranges, no fixed version, no EPSS or SSVC data, and no vendor advisory. The CVSS scores come from the CNA. Whether the maintainer intends to fix the issue is unknown.

Frequently asked questions

What is CVE-2026-55740?

An unauthenticated SQL injection in bus_info.php of the Nur-Alam39 bus-ticket project, where the busid POST parameter is concatenated into a MySQL query without sanitization or parameterization.

How severe is it?

The CNA rates it critical: CVSS 3.1 score 9.8 and CVSS 4.0 score 9.3.

Is it being exploited?

It is not in the CISA KEV catalog, and no confirmed exploitation appears in the sources consulted.

Is there a patch?

No fix is listed in the record. Users should rewrite the query using prepared statements and integer casting, and limit exposure of the application.

This analysis was drafted with AI assistance from verified source data and automatically checked against it.