Executive brief
A vulnerability exists in the Hotel and Tourism Reservation software, which is used to manage travel bookings and tour listings. An attacker can exploit this flaw to gain unauthorized access to the underlying database without needing a username or password. This could lead to the theft of sensitive customer information, reservation data, or administrative credentials, potentially disrupting business operations.
Technical details
A time-based blind SQL injection vulnerability exists in code-projects Hotel and Tourism Reservation 1.0 within the /admin/add_tour.php file. The vulnerability is caused by improper neutralization of special elements in the 'delete_image' and 'edit' GET parameters. A remote, unauthenticated attacker can exploit this by sending specially crafted HTTP requests containing SQL payloads (e.g., using the SLEEP function) to extract sensitive information from the database. A public exploit (PoC) is available, and remediation involves implementing prepared statements with parameterized queries.
Affected products
- code-projects Hotel and Tourism Reservation 1.0
Timeline
- 2026-07-05: disclosed: Vulnerability reported via VulDB and NVD
- 2026-07-05: advisory