CVE-2026-55740: Bus-Ticket SQL Injection Vulnerability

CVE-2026-55740 Overview

CVE-2026-55740 is an unauthenticated SQL injection vulnerability [CWE-89] in the Nur-Alam39 bus-ticket PHP application. The flaw resides in bus_info.php, where the busid POST parameter is concatenated directly into a MySQL query without sanitization, escaping, or parameterization. Because the parameter is used in a numeric (unquoted) context within select * from bus_info where id=$busid, a remote attacker can inject arbitrary SQL clauses, including UNION-based payloads, to extract data from the bus_service database. The application connects to MySQL as the root account with an empty password, amplifying the impact of successful injection.

Critical Impact

A remote, unauthenticated attacker can read arbitrary data from the backing MySQL database by injecting SQL through the busid POST parameter.

Affected Products

• Nur-Alam39 bus-ticket (GitHub project, no released versions)
• Latest commit 459cabdbeb99c00225b26e46e3c2c30ae1de7bad
• Vulnerable file: bus_info.php (lines 14–16)

Discovery Timeline

• 2026-06-18 - CVE-2026-55740 published to NVD
• 2026-06-18 - Last updated in NVD database

Technical Details for CVE-2026-55740

Vulnerability Analysis

The vulnerability is a classic first-order SQL injection [CWE-89] in a PHP web application that uses the mysqli extension. The handler in bus_info.php reads the busid value from an HTTP POST request and embeds it directly into a SELECT statement of the form select * from bus_info where id=$busid. No prepared statements, type casting, escaping via mysqli_real_escape_string, or input validation is applied before the value reaches the database driver.

Because busid is interpolated in a numeric position without surrounding quotes, an attacker does not need to escape any string delimiters. Arbitrary SQL tokens including UNION, ORDER BY, conditional expressions, and information_schema queries can be appended. The query executes through mysqli_query(), which does not allow stacked semicolon-separated statements, so direct INSERT, UPDATE, or DROP chaining is not possible. UNION-based and Boolean-based extraction techniques remain fully viable.

The application connects to MySQL as the root account with an empty password. Any data within the database server, not only the bus_service schema, is exposed once SQL injection is achieved.

Root Cause

The root cause is unsafe string concatenation of untrusted POST input into a SQL query. The developer relied on the assumption that busid would always be numeric and did not apply parameterized queries, integer casting, or input validation. Combined with use of the MySQL root superuser with no password, the privilege boundary between the web application and the database collapses entirely.

Attack Vector

An unauthenticated remote attacker sends a POST request to bus_info.php with a crafted busid parameter. A representative UNION-based payload referenced in the advisory is busid=-1 UNION SELECT 1,2,3,4,5,6, which forces the original query to return no rows and replaces the result set with attacker-controlled columns. From there, standard SQLi techniques enumerate information_schema to map databases and tables, then exfiltrate credentials, ticketing records, and any other data the MySQL root account can read.

No authentication, user interaction, or special privileges are required. The attack is reachable over the network on any host exposing the application.

Detection Methods for CVE-2026-55740

Indicators of Compromise

• POST requests to bus_info.php containing SQL keywords such as UNION, SELECT, SLEEP, INFORMATION_SCHEMA, or comment sequences (--, /*) in the busid parameter.
• busid values that are non-numeric or contain whitespace, parentheses, or hyphens followed by digits (for example, -1 UNION ...).
• MySQL general or error log entries showing queries against bus_info with appended UNION clauses or syntax errors originating from the web application user.
• Anomalous outbound responses from bus_info.php that include data from unrelated tables or schema metadata.

Detection Strategies

• Deploy a web application firewall rule that inspects the busid POST parameter and rejects values that are not strictly integers.
• Enable MySQL query logging and alert on queries against the bus_info table that contain UNION, INFORMATION_SCHEMA, or sub-selects.
• Review web server access logs for repeated POST requests to bus_info.php from a single source with varying busid payload lengths, consistent with automated SQLi tooling such as sqlmap.

Monitoring Recommendations

• Monitor MySQL authentication events for connections using the root account from the web server process and flag them for migration to a least-privilege user.
• Track HTTP 500 responses and database error strings returned to clients from bus_info.php, which often indicate active injection probing.
• Correlate spikes in POST volume to bus_info.php with database CPU and row-read metrics to surface bulk data exfiltration attempts.

How to Mitigate CVE-2026-55740

Immediate Actions Required

• Take the bus-ticket application offline or restrict access via network controls until the code is patched, since no vendor release exists.
• Replace the database connection account with a least-privilege MySQL user and set a strong password; do not use root with an empty password.
• Rewrite the bus_info.php query to use a prepared statement with a bound integer parameter, for example mysqli_prepare with bind_param('i', $busid).
• Cast busid to an integer with (int)$_POST['busid'] as a defense-in-depth measure before query construction.

Patch Information

No official patch or tagged release is available. The project has no released versions; the vulnerable code is present at commit 459cabdbeb99c00225b26e46e3c2c30ae1de7bad. Operators must apply source-level fixes themselves. See the GitHub Code Vulnerability Reference and the GitHub PoC Repository for the affected source lines.

Workarounds

• Place the application behind a web application firewall and enforce a strict integer-only schema on the busid parameter.
• Bind the MySQL service to localhost and isolate the web server in a dedicated network segment to limit blast radius.
• Remove the root database account from the application's connection string and revoke all privileges except SELECT on the bus_info table from the application user.

# Example: create a least-privilege MySQL user for the application
mysql -u root -p <<'SQL'
CREATE USER 'busapp'@'localhost' IDENTIFIED BY 'REPLACE_WITH_STRONG_PASSWORD';
GRANT SELECT ON bus_service.bus_info TO 'busapp'@'localhost';
FLUSH PRIVILEGES;
SQL