CVE-2020-25889

CriticalCVSS 9.8/10Last modified Jun 17, 2026

Description

Online Bus Booking System Project Using PHP/MySQL version 1.0 has SQL injection via the login page. By placing SQL injection payload on the login page attackers can bypass the authentication and can gain the admin privilege.

Metrics

CVSS 3.1 9.8/10CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

Weakness enumeration

CWE-89

Affected software

Vendor	Product	Versions
n/a	n/a	n/a

References

http://packetstormsecurity.com/files/160397/Online-Bus-Booking-System-Project-Using-PHP-MySQL-1.0-SQL-Injection.htmlExploit, Third Party Advisory, VDB Entry
http://seclists.org/fulldisclosure/2020/Dec/4Mailing List, Third Party Advisory
https://seclists.org/fulldisclosure/2020/Dec/4Mailing List, Third Party Advisory
https://www.sourcecodester.com/php/14438/online-bus-booking-system-project-using-phpmysql.htmlThird Party Advisory
http://packetstormsecurity.com/files/160397/Online-Bus-Booking-System-Project-Using-PHP-MySQL-1.0-SQL-Injection.htmlExploit, Third Party Advisory, VDB Entry
http://seclists.org/fulldisclosure/2020/Dec/4Mailing List, Third Party Advisory
https://seclists.org/fulldisclosure/2020/Dec/4Mailing List, Third Party Advisory
https://www.sourcecodester.com/php/14438/online-bus-booking-system-project-using-phpmysql.htmlThird Party Advisory

Timeline

Published: Dec 8, 2020
Last modified: Jun 17, 2026
NVD status: Modified

Related CVEs from 2020

CVE-2020-25894.9Vulnerability in the MySQL Server product of Oracle MySQL (component: InnoDB). Supported versions that are affected are 5.7.28 and prior and CVE-2020-258906.1The web application of Kyocera printer (ECOSYS M2640IDW) is affected by Stored XSS vulnerability, discovered in the addition a new contact i CVE-2020-25903.7Vulnerability in the Java SE, Java SE Embedded product of Oracle Java SE (component: Security). Supported versions that are affected are Jav CVE-2020-259005.3HelloTalk through 3.4.1 stores full-precision GPS coordinates even when the user had intended to share only a country or city. Furthermore, CVE-2020-259016.1Host Header Injection in Spiceworks 7.5.7.0 allowing the attacker to render arbitrary links that point to a malicious website with poisoned CVE-2020-259026.1Blackboard Collaborate Ultra 20.02 is affected by a cross-site scripting (XSS) vulnerability. The XSS payload will execute on the class room CVE-2020-259059.8An SQL Injection vulnerabilty exists in Sourcecodester Mobile Shop System in PHP MySQL 1.0 via the email parameter in (1) login.php or (2) L CVE-2020-25918.2Vulnerability in the Oracle Web Applications Desktop Integrator product of Oracle E-Business Suite (component: Application Service). The sup CVE-2020-259119.1A XML External Entity (XXE) vulnerability was discovered in the modRestServiceRequest component in MODX CMS 2.7.3 which can lead to an infor CVE-2020-259129.1A XML External Entity (XXE) vulnerability was discovered in symphony\lib\toolkit\class.xmlelement.php in Symphony 2.7.10 which can lead to a CVE-2020-259155.4Cross Site Scripting (XSS) vulnerability in UserController.php in ThinkCMF version 5.1.5, allows attackers to execute arbitrary code via cra CVE-2020-259178.8Stratodesk NoTouch Center before 4.4.68 is affected by: Incorrect Access Control. A low privileged user on the platform, for example a user