CVE-2023-53877 is a critical SQL injection flaw (CVSS 9.8) in PHPJabbers Bus Reservation System 1.1. The pickup_id parameter is not handled safely, so an attacker can change database queries and steal information. No fixed version is confirmed, so check with the vendor and limit exposure.
What's affected
The CVE record and VulnCheck list Bus Reservation System 1.1 from PHPJabbers. The description says the pickup_id parameter allows manipulation of database queries, and names boolean based, error based and time based blind techniques as ways to steal information. The record links a public exploit listing.
I could not confirm a fixed version from the sources available, so check the vendor site and release notes for a newer release. PHPJabbers sells its scripts as downloadable PHP code, so each customer runs their own copy and updates it by hand.
How to check if you're exposed
Find the version in the admin area of your installation or in the files you received from the vendor. Version 1.1 is the version named in the record.
Then look at your web server logs for requests to the booking pages with unusual values in the pickup_id parameter, such as long values, quotes, or database keywords. A burst of failed requests with database errors in the response is a warning sign.
A static code scan of your own customisations can also help, because scripts bought from vendors are often edited. If you have the source, a SAST scan will show where input reaches a query without parameter binding.
What to do now
- Confirm the version of Bus Reservation System on each site.
- Ask PHPJabbers for a fixed version, and apply it as soon as one exists.
- Put a web application firewall in front of the site and enable SQL injection rules, as a temporary measure.
- Give the database user for the application only the rights it needs, so a successful injection reaches less.
- Check logs for suspicious requests, and rotate database credentials if you suspect misuse.
Why it matters
SQL injection (CWE-89) comes from building a database query by pasting user input into it as text. The database then treats part of that input as instructions. The standard fix is parameterised queries, where the values are passed separately from the query text, so input is never read as code.
Booking systems store names, contact details and sometimes payment related records, so an injection that reads the database is a data breach. The NVD score of 9.8 reflects an unauthenticated network attack with high impact. VulnCheck scores it 9.3 on the newer version. Neither the record nor the sources I fetched report attacks in the wild, and the CVE is not on the CISA Known Exploited Vulnerabilities list.
Try it yourself
Click through it at your own pace, or open it full screen.
Quick check
What is the long term fix?
Parameterised queries in the code that handles pickup_id and every other input that reaches a query.
Does a firewall solve it?
It reduces risk as a stopgap, but the vulnerable code stays until the vendor fixes it.
Sources
Last reviewed: 19 October 2026.
