Executive brief
A security vulnerability exists in the Hotel and Tourism Reservation System, a software package used for managing travel and lodging bookings. An attacker can exploit this flaw to gain unauthorized access to the underlying database, potentially allowing them to view, modify, or delete sensitive information such as customer records and reservation details. This could lead to significant data breaches, loss of customer trust, and disruption of business operations.
Technical details
A SQL injection vulnerability exists in the 'tour' GET parameter of the tour.php file in Hotel and Tourism Reservation System 1.0. The application fails to sanitize the 'tour' parameter before interpolating it directly into a raw SQL query (e.g., SELECT * FROM tourism WHERE id = '{$tourID}'). A remote, unauthenticated attacker can exploit this by sending crafted HTTP GET requests to manipulate database queries. Successful exploitation allows for full database enumeration, including the extraction of user credentials and reservation data. A public exploit (PoC) and sqlmap instructions have been disclosed. No official patch is currently documented, but the vulnerability can be mitigated by implementing prepared statements with parameterized queries.
Affected products
- code-projects Hotel and Tourism Reservation System 1.0
Timeline
- 2026-06-01: disclosed: Vulnerability details and PoC published on GitHub
- 2026-06-01: advisory: NVD and VulDB published advisory data