The class 12 student discovered the bug that leaked the transaction details of millions of travelers, when he was trying to book tickets on August 30