Eshmurzayev Abbos

**Name of the Vulnerable Software and Affected Versions** Nur-Alam39 bus-ticket (affected versions not specified) **Description** An unauthenticated SQL injection exists in the 'bus info.php' endpoint. The `busid` parameter, received via HTTP POST, is concatenated directly into a MySQL query without sanitization, escaping, or parameterization. This allows a remote attacker to inject arbitrary SQL, such as UNION-based payloads, to read data from the `bus service` database. The impact is increased because the application connects to the database using the MySQL root account with an empty password. The query is executed via the `mysqli query()` function, which does not support stacked statements. **Recommendations** At the moment, there is no information about a newer version that contains a fix for this vulnerability.