Executive brief
Tourism Management System is a web-based platform used to manage tourism operations across attractions, hotels, and bookings. A flaw in the CommonController allows attackers to manipulate database query parameters, exposing sensitive information from the backend database without requiring authentication.
Technical details
The vulnerability is a SQL injection or unsafe query parameter manipulation in the getOption function of CommonController.java (travel/src/main/java/com/controller/CommonController.java). An attacker can remotely manipulate the tableName and columnName parameters to extract arbitrary data from the database. The attack requires no authentication and can be launched over the network. The vulnerability has been publicly disclosed and a patch (commit d44ec3aa0bd2a72c8800e3befb0a9a96a6491b86) is available.
Affected products
- jaychouchannel Tourism Management System up to commit 8122bf020d91199eddfff3ee02d1632a70a9a132
Timeline
- 2026-09-07: disclosed
- 2026-09-07: patched: Patch commit d44ec3aa0bd2a72c8800e3befb0a9a96a6491b86