CVE-2020-25889
9.8
CRITICAL · CVSS 3.1 · EPSS 2.8% (pctl 86)
In your normal cycle
Critical by CVSS (9.8), but no sign of active exploitation.
Description
Online Bus Booking System Project Using PHP/MySQL version 1.0 has SQL injection via the login page. By placing SQL injection payload on the login page attackers can bypass the authentication and can gain the admin privilege.
Scoring
| CVSS | 9.8 (CRITICAL, v3.1) |
|---|---|
| Vector | CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H |
| EPSS | 2.76% — more likely to be exploited than 86% of all CVEs |
| Weakness | CWE-89 |
| On CISA KEV | no |
| Public exploit | none known |
| Published | 2020-12-08 |
| Last modified | 2026-06-17 |
Affected (1)
| Vendor | Product |
|---|---|
| online bus booking system project | online bus booking system |
References
- http://packetstormsecurity.com/files/160397/Online-Bus-Booking-System-Project-Using-PHP-MySQL-1.0-SQL-Injection.html
- http://seclists.org/fulldisclosure/2020/Dec/4
- https://seclists.org/fulldisclosure/2020/Dec/4
- https://www.sourcecodester.com/php/14438/online-bus-booking-system-project-using-phpmysql.html
- http://packetstormsecurity.com/files/160397/Online-Bus-Booking-System-Project-Using-PHP-MySQL-1.0-SQL-Injection.html
- http://seclists.org/fulldisclosure/2020/Dec/4
- https://seclists.org/fulldisclosure/2020/Dec/4
- https://www.sourcecodester.com/php/14438/online-bus-booking-system-project-using-phpmysql.html
→ the Explorer · watch your stack · NVD