Which versions of Nur-Alam39 bus-ticket are affected by EUVD-2026-37851?

Nur-Alam39's bus-ticket application contains a critical vulnerability allowing any remote attacker to steal passenger data, payment information, and operational records without authentication.

How to fix or mitigate EUVD-2026-37851?

Within 24 hours: isolate the bus-ticket application from production networks or shut it down completely to prevent unauthorized data access. Within 7 days: execute emergency procurement and deployment of alternative bus-ticket solution with verified security practices; conduct forensic assessment to determine if data exfiltration has occurred and initiate breach notification process if required. Within 30 days: complete full migration to replacement system, change all MySQL database credentials from root to least-privilege accounts, and perform security review of any systems that shared data with or credentials with this application.

Nur-Alam39 bus-ticket EUVD-2026-37851

Q: What is the CVSS score of EUVD-2026-37851?

EUVD-2026-37851 has a CVSS 4.0 base score of 9.3 (Critical). CVSS vector: CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X. EPSS exploitation probability: 0.4%.

| CVE-2026-55740 CRITICAL

SQL Injection (CWE-89)

2026-06-18 TuranSec

GHSA-482v-954j-6xv2

PHP SQLi Bus Ticket

9.3

CVSS 4.0 · Vendor: TuranSec

Severity by source

Vendor (TuranSec) PRIMARY

9.3 CRITICAL

CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X

vuln.today AI

9.8 CRITICAL

Remote single-POST exploitation with no auth or UI (AV:N/AC:L/PR:N/UI:N); MySQL root access yields full confidentiality, integrity, and availability impact on the database.

3.1 AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

4.0 AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N

Primary rating from Vendor (TuranSec).

CVSS VectorVendor: TuranSec

Attack Vector

Network

Attack Complexity

Low

Privileges Required

None

User Interaction

None

Scope

Lifecycle Timeline

Analysis Updated

Jun 18, 2026 - 06:43 vuln.today

v3 (cvss_changed)

Analysis Updated

Jun 18, 2026 - 06:43 vuln.today

v2 (cvss_changed)

Re-analysis Queued

Jun 18, 2026 - 06:37 vuln.today

cvss_changed

CVSS changed

Jun 18, 2026 - 06:37 NVD

9.8 (CRITICAL) 9.3 (CRITICAL)

Analysis Generated

Jun 18, 2026 - 06:17 vuln.today

CVE Published

Jun 18, 2026 - 05:48 cve.org

CRITICAL 9.8

DescriptionCVE.org

Nur-Alam39 bus-ticket (no released versions; latest commit 459cabdbeb99c00225b26e46e3c2c30ae1de7bad) contains an unauthenticated SQL injection vulnerability in bus_info.php. The busid parameter received via HTTP POST is concatenated directly into a MySQL query (select * from bus_info where id=$busid) without sanitization, escaping, or parameterization, and in a numeric (unquoted) context. A remote, unauthenticated attacker can inject arbitrary SQL - for example a UNION-based payload such as busid=-1 UNION SELECT 1,2,3,4,5,6 - to read arbitrary data from the bus_service database. The application connects to the database as the MySQL root account with an empty password, increasing the potential impact. The query is executed via mysqli_query(), which does not permit stacked (semicolon-separated) statements.

Articles & Coverage 1

News Critical SQL Injection in Nur-Alam39 Bus-Ticket PHP Application - CVE-2026-55740 Jun 19, 2026

AnalysisAI

Unauthenticated SQL injection in Nur-Alam39's bus-ticket PHP application (no released versions; latest commit 459cabd) allows remote attackers to extract arbitrary data from the bus_service database via the busid POST parameter in bus_info.php. The flaw is exacerbated because the application connects as MySQL root with an empty password. No public exploit identified at time of analysis, though the description includes a working UNION-based payload demonstrating trivial exploitability.

Technical ContextAI

The vulnerability is a classic CWE-89 (SQL Injection) in a PHP web application built on the LAMP stack using the mysqli extension. The vulnerable code path in bus_info.php (lines 14-16 per the GitHub reference) concatenates the user-supplied busid POST parameter directly into the query 'select * from bus_info where id=$busid' in an unquoted numeric context, meaning attackers do not even need to break out of quotes. Because the query executes via mysqli_query() - which rejects stacked statements - the immediate attack surface is limited to SELECT-style injection (UNION, subqueries, conditional blind), but combined with the MySQL root account with empty password, an attacker can read across all databases on the server and potentially write files via INTO OUTFILE if FILE privilege and secure_file_priv allow it.

RemediationAI

No vendor-released patch identified at time of analysis - the upstream repository has no fix commit and no tagged releases. Operators running this code should immediately take the application offline or, as compensating controls, replace the vulnerable query in bus_info.php with a prepared statement using mysqli_prepare()/bind_param() with an 'i' type for busid, or at minimum wrap the input with (int)$_POST['busid'] before concatenation (trade-off: still fragile if other parameters are added later). Additionally, change the MySQL connection account from root with empty password to a least-privilege user limited to the bus_service database with only SELECT/INSERT/UPDATE on the required tables (trade-off: requires DB schema review). A WAF rule blocking UNION, SELECT, or non-numeric characters in the busid parameter can serve as a short-term filter but is easily bypassed and should not be relied upon. Track upstream at https://github.com/Nur-Alam39/bus-ticket for any future fix.