The Nur-Alam39 bus-ticket application has an unauthenticated SQL injection vulnerability (CWE-89) in bus_info.php. The busid parameter received via HTTP POST is concatenated directly into a MySQL query without sanitization, escaping, or parameterization, in a numeric context. This enables remote attackers to inject arbitrary SQL, such as UNION-based payloads, to extract data from the bus_service database. The application connects to MySQL as root with an empty password, increasing the severity. The query execution via mysqli_query() disallows stacked queries, limiting some attack vectors. No official remediation or patch is currently available.

An unauthenticated remote attacker can exploit this vulnerability to execute arbitrary SQL queries on the backend database, potentially reading sensitive data from the bus_service database. The use of the MySQL root account with no password exacerbates the impact, possibly allowing full database compromise. The vulnerability affects confidentiality, integrity, and availability, as reflected by the CVSS 3.1 score of 9.8 (critical).

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until a fix is available, it is recommended to implement input validation and parameterized queries to prevent SQL injection. Additionally, the database should not be accessed using the root account with an empty password; proper database user privileges and strong authentication should be enforced.