The vulnerability is an unauthenticated SQL injection located in the bus_info.php script of the Nur‑Alam39 bus‑ticket application. User supplied data is read from the busid parameter in an HTTP POST request and concatenated directly into a numeric, unquoted SQL query through the mysqli_query function. Because the query is performed under the MySQL root account with an empty password, a malicious actor can craft payloads such as a UNION SELECT to read arbitrary data from the bus_service database table. No further sanitization is performed, so the application can expose sensitive information stored in the database. This flaw corresponds to CWE‑89, where unsanitized input is used in SQL queries.

Nur‑Alam39 bus‑ticket, currently without an officially released version; the latest commit pointer referenced in the advisory is 459cabd. The problem exists in the bus_info.php file accessed via the web application.

The CVSS score of 9.3 indicates a high severity impact on confidentiality. The EPSS score of less than 1% suggests a low probability of widespread exploitation at present, and the vulnerability is not listed in the CISA KEV catalog. However, because the flaw is unauthenticated and the database credentials are default root/account with an empty password, attackers can reach the service remotely over HTTP, injecting SQL without authentication to retrieve data from the entire database. The use of mysqli_query without stacked statements limits payload complexity but still permits UNION based extraction. The risk is highest in environments where the application is directly exposed and database access is not properly constrained.