Description

A weakness has been identified in jaychouchannel Tourism-Management-System up to 8122bf020d91199eddfff3ee02d1632a70a9a132. Affected is an unknown function of the file travel/src/main/java/com/controller/CommonController.java of the component CommonDao. Executing a manipulation of the argument table/column/xColumn/yColumn can lead to sql injection. The attack can be launched remotely. The exploit has been made available to the public and could be used for attacks. This product does not use versioning. This is why information about affected and unaffected releases are unavailable. This patch is called d44ec3aa0bd2a72c8800e3befb0a9a96a6491b86. A patch should be applied to remediate this issue.

Executive Summary

Technical Details

Mitigations

References

Additional Metadata

{
  "score": "7.3",
  "pubDate": "2026-09-07T08:17:14.590Z",
  "pubdate": "2026-09-07T08:17:14.590Z",
  "executiveSummary": "A critical SQL injection vulnerability exists within the CommonDao component of the Tourism-Management-System, specifically impacting the CommonController.java file.\nThe vulnerability arises from improper neutralization of user-supplied input used in database queries, allowing remote, unauthenticated attackers to manipulate SQL statements.\nSuccessful exploitation permits unauthorized data access, modification, or deletion, potentially compromising the integrity and confidentiality of the underlying database.\nThis flaw is considered high-risk due to the availability of public exploit material and the potential for remote execution without requiring prior authentication.\nAffected systems include versions of jaychouchannel Tourism-Management-System up to commit 8122bf020d91199eddfff3ee02d1632a70a9a132. Immediate remediation via the provided security patch is recommended to mitigate risk.",
  "technicalDetails": "The vulnerability is an SQL injection flaw located within the CommonController.java file, specifically within the CommonDao component functionality. The root cause is the insecure construction of SQL queries using unsanitized user-controllable input from HTTP request parameters.\nThe application fails to employ parameterized queries or prepared statements when processing input for the 'table', 'column', 'xColumn', or 'yColumn' arguments. By injecting malicious SQL syntax into these specific parameters, an attacker can bypass the intended query logic. This allows for the manipulation of the WHERE clause or other SQL structural components, facilitating unauthorized interaction with the database engine.\nThe attack flow initiates when a remote, unauthenticated user sends a specifically crafted HTTP request to the application. The vulnerable function within CommonController.java receives the user input via the specified parameters ('table', 'column', 'xColumn', or 'yColumn') and passes these values directly into a database query constructor without sufficient sanitization or validation.\nOnce the malicious payload is processed, the backend database interprets the injected SQL commands as part of the intended query. Depending on the injection type, an attacker may perform union-based attacks to extract data from other tables, error-based attacks to deduce database schema information, or blind injection techniques to infer data bit-by-bit.\nThe post-exploitation impact includes full unauthorized access to database contents, including potentially sensitive user information, configuration data, or administrative credentials. In some scenarios, depending on the database permissions configured for the application, an attacker may be able to modify database contents, drop tables, or potentially execute OS-level commands if the database environment allows such functionality.\nAffected versions include all iterations up to commit 8122bf020d91199eddfff3ee02d1632a70a9a132. There is no versioning system in place, and the vulnerability is remediated by applying patch d44ec3aa0bd2a72c8800e3befb0a9a96a6491b86."
}