CVE-2020-25889

Online Bus Booking System Project Using PHP/MySQL version 1.0 has SQL injection via the login page. By placing SQL injection payload on the login page attackers can bypass the authentication and can gain the admin privilege.

• CWE-89

• http://packetstormsecurity.com/files/160397/Online-Bus-Booking-System-Project-Using-PHP-MySQL-1.0-SQL-Injection.htmlExploit, Third Party Advisory, VDB Entry
• http://seclists.org/fulldisclosure/2020/Dec/4Mailing List, Third Party Advisory
• https://seclists.org/fulldisclosure/2020/Dec/4Mailing List, Third Party Advisory
• https://www.sourcecodester.com/php/14438/online-bus-booking-system-project-using-phpmysql.htmlThird Party Advisory
• http://packetstormsecurity.com/files/160397/Online-Bus-Booking-System-Project-Using-PHP-MySQL-1.0-SQL-Injection.htmlExploit, Third Party Advisory, VDB Entry
• http://seclists.org/fulldisclosure/2020/Dec/4Mailing List, Third Party Advisory
• https://seclists.org/fulldisclosure/2020/Dec/4Mailing List, Third Party Advisory
• https://www.sourcecodester.com/php/14438/online-bus-booking-system-project-using-phpmysql.htmlThird Party Advisory

Published

Dec 8, 2020

Last Modified

Jun 17, 2026

Status

Modified

• How Strix found a critical auth bypass in etcdStrix autonomously discovered a critical authentication bypass in etcd, later designated CVE-2026-33413.
• Autonomous PentestingAI agents that find and validate exploitable vulnerabilities like this one across your applications.
• PR ReviewsPentest every pull request so vulnerable code is caught before it ships to production.
• AI Penetration TestingHow AI-driven penetration testing continuously covers your attack surface.

• CVE-2020-25877A stored cross site scripting (XSS) vulnerability in the 'Ad…5.4
• CVE-2020-25878A stored cross site scripting (XSS) vulnerability in the 'Ad…4.8
• CVE-2020-25879A stored cross site scripting (XSS) vulnerability in the 'Ma…5.4
• CVE-2020-2588Vulnerability in the MySQL Server product of Oracle MySQL (c…4.9
• CVE-2020-25881A vulnerability was discovered in the filename parameter in …5.5
• CVE-2020-25887Buffer overflow in mg_resolve_from_hosts_file in Mongoose 6.…8.8
• CVE-2020-2589Vulnerability in the MySQL Server product of Oracle MySQL (c…4.9
• CVE-2020-25890The web application of Kyocera printer (ECOSYS M2640IDW) is …6.1
• CVE-2020-2590Vulnerability in the Java SE, Java SE Embedded product of Or…3.7
• CVE-2020-25900HelloTalk through 3.4.1 stores full-precision GPS coordinate…5.3
• CVE-2020-25901Host Header Injection in Spiceworks 7.5.7.0 allowing the att…6.1
• CVE-2020-25902Blackboard Collaborate Ultra 20.02 is affected by a cross-si…6.1