The vulnerability is an unauthenticated SQL injection located in the bus_info.php script of the Nur‑Alam39 bus‑ticket application. User supplied data is read from the busid parameter in an HTTP POST request and concatenated directly into a numeric, unquoted SQL query without sanitization or parameterization. This flaw allows an attacker to craft SQL payloads, such as UNION SELECT statements, to read arbitrary data from the database, thereby exposing sensitive information. The issue corresponds to CWE‑89, which describes the use of unsanitized input in SQL queries.

Nur‑Alam39 bus‑ticket, currently without an officially released version; the latest commit pointer referenced in the advisory is 459cabd. The problem exists in the bus_info.php file accessed via the web application.

The CVSS score of 9.3 indicates a high severity impact on confidentiality. The EPSS score of less than 1% suggests a low probability of widespread exploitation at present, and the vulnerability is not listed in the CISA KEV catalog. However, because the flaw is unauthenticated and the application accepts the busid parameter via HTTP POST, attackers can reach the service remotely over HTTP, injecting SQL without authentication to retrieve data from the entire database. The use of mysqli_query without stacked statements limits payload complexity but still permits UNION based extraction. The risk is highest in environments where the application is directly exposed and database access is not properly constrained.