CVE-2023-45015
📋 TL;DR
Online Bus Booking System v1.0 contains unauthenticated SQL injection vulnerabilities in the bus_info.php file's 'date' parameter. Attackers can execute arbitrary SQL commands without authentication, potentially compromising the entire database. All deployments of this specific software version are affected.
💻 Affected Systems
- Online Bus Booking System
📦 What is this software?
Online Bus Booking System by Online Bus Booking System Project
⚠️ Risk & Real-World Impact
Worst Case
Complete database compromise including data theft, data manipulation, authentication bypass, and potential remote code execution via database functions.
Likely Case
Database information disclosure, credential theft, and potential privilege escalation leading to system compromise.
If Mitigated
Limited impact with proper input validation and database permissions, though SQL injection attempts would still be logged.
🎯 Exploit Status
SQL injection via date parameter requires minimal technical skill and is easily automated.
🛠️ Fix & Mitigation
✅ Official Fix
Patch Version: Unknown
Vendor Advisory: Not available
Restart Required: No
Instructions:
No official patch available. Implement parameterized queries and input validation in bus_info.php.
🔧 Temporary Workarounds
Web Application Firewall (WAF)
allDeploy WAF rules to block SQL injection patterns in the date parameter
Input Validation Filter
allAdd server-side validation to only accept valid date formats in the date parameter
🧯 If You Can't Patch
- Isolate the system behind a reverse proxy with strict input validation
- Implement database user with minimal permissions (read-only if possible)
🔍 How to Verify
Check if Vulnerable:
Test bus_info.php with SQL injection payloads in date parameter (e.g., ' OR '1'='1)Check Version:
Check software version in admin panel or configuration filesVerify Fix Applied:
Verify parameterized queries are implemented and SQL injection attempts return errors📡 Detection & Monitoring
Log Indicators:
- Unusual SQL errors in application logs
- Multiple failed date parameter requests
- SQL keywords in date parameter values
Network Indicators:
- SQL injection patterns in HTTP requests to bus_info.php
- Unusual database connection patterns
SIEM Query:
source="web_logs" AND uri="*bus_info.php*" AND (request="*OR*" OR request="*UNION*" OR request="*SELECT*" OR request="*--*" OR request="*;*" OR request="*'*'*'*")