Description

A security vulnerability has been detected in jaychouchannel Tourism-Management-System up to 8122bf020d91199eddfff3ee02d1632a70a9a132. Affected by this vulnerability is the function getOption of the file travel/src/main/java/com/controller/CommonController.java. The manipulation of the argument tableName/columnName leads to information disclosure. The attack may be initiated remotely. The exploit has been disclosed publicly and may be used. This product uses a rolling release model to deliver continuous updates. As a result, specific version information for affected or updated releases is not available. The identifier of the patch is d44ec3aa0bd2a72c8800e3befb0a9a96a6491b86. To fix this issue, it is recommended to deploy a patch.

Executive Summary

Technical Details

Mitigations

References

Additional Metadata

{
  "score": "5.3",
  "pubDate": "2026-09-07T08:17:14.820Z",
  "pubdate": "2026-09-07T08:17:14.820Z",
  "executiveSummary": "A critical information disclosure vulnerability has been identified in the Tourism-Management-System developed by jaychouchannel.\nThe vulnerability is localized within the getOption function of the CommonController.java file, stemming from improper input sanitization of the tableName and columnName parameters.\nThe flaw enables remote unauthenticated attackers to manipulate database queries, leading to unauthorized data exposure.\nThis vulnerability poses a significant risk to data confidentiality, as attackers can extract sensitive information directly from the underlying database through the manipulation of these input vectors.\nThe lack of adequate query parameterization allows for SQL Injection (SQLi), which can be exploited remotely without requiring prior authentication.\nThe vulnerability affects all versions up to commit 8122bf020d91199eddfff3ee02d1632a70a9a132, and given the nature of the software's rolling release model, users are urged to audit their current deployment against the provided patch identifier.",
  "technicalDetails": "The vulnerability resides in the getOption function within the travel/src/main/java/com/controller/CommonController.java file of the Tourism-Management-System. The root cause is the improper handling of user-supplied input for the tableName and columnName arguments, which are concatenated directly into SQL query strings without sanitization, parameterization, or the use of prepared statements.\nThis architecture creates a classic SQL Injection (SQLi) vector. An attacker can supply malicious SQL fragments or payloads through these parameters to alter the intended logic of the database query executed by the controller. By injecting crafted input, an attacker can coerce the application into returning information from arbitrary tables or columns within the database schema that the application is authorized to access.\nThe attack flow proceeds as follows: 1. The attacker identifies the publicly exposed endpoint associated with the getOption function. 2. The attacker crafts a request containing a malicious payload injected into the tableName or columnName parameters. 3. The server-side application processes the request and embeds the unvalidated input directly into a SQL statement. 4. The database engine parses and executes the tainted query. 5. The application returns the results of the modified query to the attacker, facilitating the unauthorized retrieval of database content.\nBecause the function does not perform input validation or enforce strict allow-listing of the table or column names, an attacker can utilize UNION-based SQL injection techniques to append results from other tables, effectively leaking the structure or sensitive contents of the entire database. This vulnerability is remotely exploitable and does not require the attacker to possess authentication credentials or specific privileges within the application environment.\nThe post-exploitation impact includes full unauthorized access to database records, metadata, and potentially sensitive user or system data stored within the backend storage. The lack of a secure abstraction layer for database access within this specific controller makes the system highly susceptible to such information disclosure attacks, necessitating immediate remediation via input validation and the implementation of parameterized queries or Object-Relational Mapping (ORM) best practices to neutralize the injection vector."
}