CVE-2023-53877

Attackers can inject malicious SQL code fragments through the pickup_id parameter in HTTP requests without needing any privileges. The vulnerability enables the use of three techniques: boolean-based blind SQL injection (inferring data based on true/false responses), error-based SQL injection (extracting information from database error messages), and time-based blind SQL injection (inferring data based on server response time). All three techniques allow gradual extraction of database contents despite the lack of direct display of query results.

Attackers can read or modify data stored in the application's database, including potentially personal passenger data, reservations, and authentication credentials. High level of impact on data confidentiality and integrity may lead to data theft or unauthorized modification.

Apply patches available from the vendor according to references. Additionally, it is recommended to implement validation and parameterization of SQL queries on the server side, as well as to restrict access to the application at the firewall level to trusted IP addresses, if possible.

PHPJabbers Bus Reservation System version 1.1