| Title | code-projects Vehicle Management System in PHP 1.0 SQL Injection |
|---|
| Description | A potential SQL injection vulnerability has been identified in the Vehicle Management System in PHP within the bus profile functionality.
The vulnerability affects the busid parameter of the busprofile.php endpoint. This parameter is used by the application to identify and retrieve information associated with a specific bus record.
The application appears to process the supplied identifier in a backend database query. When unexpected SQL metacharacters, including single quotation marks, are supplied through the busid parameter, the application's response reportedly changes in a manner consistent with unsafe SQL query construction.
The tested parameter value is:
25'
If the application directly concatenates this value into an SQL statement, the supplied quotation marks can affect the syntactic structure of the database query. This behavior may allow an attacker to inject additional SQL expressions into the affected statement.
Depending on the exact query construction and database permissions, successful exploitation of a confirmed SQL injection vulnerability could permit unauthorized access to information stored in the application's database. Potentially affected information may include vehicle records, bus information, user accounts, administrative information, operational records, and other data maintained by the Vehicle Management System.
In more severe scenarios, SQL injection may allow modification or deletion of database records if the affected database account possesses write permissions. The actual impact should be determined through controlled testing of the affected application rather than inferred solely from the malformed-input response.
The root cause is improper separation of user-controlled input from SQL commands. The application should use parameterized queries and prepared statements for all database operations involving the busid parameter. |
|---|
| Source | ⚠️ https://github.com/ahmadmarz10-hub/CVEsMarz/blob/main/SQL%20Injection%20Vulnerability%20in%20Vehicle%20Management%20System%20%60busid%60%20Parameter.md |
|---|
| User | AhmadMarzook (UID 96211) |
|---|
| Submission | 07/18/2026 19:39 (2 months ago) |
|---|
| Moderation | 09/04/2026 07:57 (2 months later) |
|---|
| Status | Accepted |
|---|
| VulDB entry | 398680 [code-projects Vehicle Management System 1.0 /busprofile.php busid sql injection] |
|---|
| Points | 20 |
|---|