CVE-2026-55740 Details

A SQL injection vulnerability has been identified in the Nur-Alam39 bus-ticket application, specifically in the bus_info.php file. This vulnerability allows remote, unauthenticated attackers to inject arbitrary SQL into a MySQL query. The issue arises because the busid parameter, received via HTTP POST, is directly concatenated into a SQL query without any form of sanitization, escaping, or parameterization, and is treated as a numeric value in an unquoted context. The injected SQL can be used to read arbitrary data from the bus_service database. The application connects to the database using the MySQL root account with an empty password, which amplifies the potential impact of the vulnerability.