CVE-2023-45019

CRITICAL

Online Bus Booking System 1.0 - Unauthenticated SQL Injection via Category Parameter

Title source: llm

Description

Online Bus Booking System v1.0 is vulnerable to multiple Unauthenticated SQL Injection vulnerabilities. The 'category' parameter of the category.php resource does not validate the characters received and they are sent unfiltered to the database.

References (2)

Core 2

Core References

Product

https://projectworlds.in/

Exploit, Third Party Advisory third-party-advisory

https://fluidattacks.com/advisories/oconnor

Scores

CVSS v3 9.8

EPSS 0.0070

EPSS Percentile 48.7%

Attack Vector NETWORK

CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

CISA SSVC

Vulnrichment

Exploitation poc

Automatable yes

Technical Impact total

Details

CWE

CWE-89

Status published

Products (1)

online_bus_booking_system_project/online_bus_booking_system 1.0

Published Nov 02, 2023

Tracked Since Feb 18, 2026