CVE-2026-55740: SQL Injection in Nur-Alam39 bus-ticket bus_info.php via busid parameter

Synopsis

SQL injection in Nur-Alam39 bus-ticket allows a remote, unauthenticated attacker to inject arbitrary SQL through the busid parameter in bus_info.php, which is concatenated directly into a MySQL query without any sanitization or parameterization. The service is reachable over the network and requires no credentials, and the application connects to MySQL as root with an empty password. Successful exploitation gives the attacker full read and write access to the underlying database, as well as the ability to crash or corrupt database state. HarborGuard tracks this advisory and will make a patched-image rebuild available the moment an upstream fix is published.

HarborGuard Coverage

Exploit Conditions

• Network reachabilityRequired

  The vulnerable endpoint is exposed over HTTP, so the attacker must be able to reach the service across a network.

• AuthenticationNot required

  No credentials are needed; the vulnerable bus_info.php endpoint accepts unauthenticated POST requests.

• Victim interactionNot required

  The attacker sends a crafted HTTP POST request directly to the server; no user interaction is involved.

• Attack complexityDetail

  Exploitation is straightforward and condition-free: the injection point is a numeric, unquoted parameter that accepts a simple UNION-based payload with no timing, memory layout, or environmental dependencies.

Blast Radius

• Reads arbitrary rows and columns from the bus_service database, including any stored user credentials, personal information, and booking records.
• Modifies or deletes persisted database rows, because the application connects as the MySQL root account with an empty password, granting full DML and DDL privileges.
• Drops or truncates database tables, destroying application data and causing service disruption.
• Enumerates other databases accessible to the root account on the same MySQL instance, extending the breach beyond the bus_service schema.