CVEvulnerability
CVE-2020-25889
9.8 CRITICAL
Official page ↗
- Status
- Modified
- Published
- 2020-12-08
- Last modified
- 2026-06-17
- Assigner
- [email protected]
- CVSS 3.1 ([email protected])
- 9.8 CRITICAL — CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
- CVSS 2.0 ([email protected])
- 7.5 HIGH — AV:N/AC:L/Au:N/C:P/I:P/A:P
- Weaknesses
- CWE-89
Description
Online Bus Booking System Project Using PHP/MySQL version 1.0 has SQL injection via the login page. By placing SQL injection payload on the login page attackers can bypass the authentication and can gain the admin privilege.
Affected configurations
• online bus booking system project online bus booking system 1.0
Related
Weakness · CWE (1)
- CWE-89 Improper Neutralization of Special Elements used in an SQL Command weakness
References
- http://packetstormsecurity.com/files/160397/Online-Bus-Booking-System-Project-Using-PHP-MySQL-1.0-SQL-Injection.html Exploit, Third Party Advisory, VDB Entry
- http://seclists.org/fulldisclosure/2020/Dec/4 Mailing List, Third Party Advisory
- https://seclists.org/fulldisclosure/2020/Dec/4 Mailing List, Third Party Advisory
- https://www.sourcecodester.com/php/14438/online-bus-booking-system-project-using-phpmysql.html Third Party Advisory
- http://packetstormsecurity.com/files/160397/Online-Bus-Booking-System-Project-Using-PHP-MySQL-1.0-SQL-Injection.html Exploit, Third Party Advisory, VDB Entry
- http://seclists.org/fulldisclosure/2020/Dec/4 Mailing List, Third Party Advisory
- https://seclists.org/fulldisclosure/2020/Dec/4 Mailing List, Third Party Advisory
- https://www.sourcecodester.com/php/14438/online-bus-booking-system-project-using-phpmysql.html Third Party Advisory