Description

A vulnerability was determined in jaychouchannel Tourism-Management-System up to d984d172dceca907f8b447efbdb06dc233f7938d. Impacted is the function resetPass of the file UsersController.java of the component Password Recovery. This manipulation causes weak password recovery. The attack can be initiated remotely. The exploit has been publicly disclosed and may be utilized. Continious delivery with rolling releases is used by this product. Therefore, no version details of affected nor updated releases are available. Patch name: 9cb6215ac871f99a90cde763cf003e95ff282283. It is recommended to apply a patch to fix this issue.

Executive Summary

Technical Details

Mitigations

References

Additional Metadata

{
  "score": "7.3",
  "pubDate": "2026-09-13T13:16:29.090Z",
  "pubdate": "2026-09-13T13:16:29.090Z",
  "executiveSummary": "A critical security vulnerability exists in the Password Recovery component of the Tourism-Management-System, specifically within the resetPass function of UsersController.java.\nThe flaw allows for weak password recovery, which can be exploited by a remote, unauthenticated attacker to gain unauthorized access to user accounts.\nThis vulnerability poses a significant risk to system integrity and user data confidentiality, as it bypasses standard secure authentication workflows.\nThe vulnerability is publicly disclosed, increasing the likelihood of active exploitation by malicious actors.\nThe product utilizes rolling releases, necessitating immediate application of the provided patch (9cb6215ac871f99a90cde763cf003e95ff282283) to remediate the flaw.\nSuccessful exploitation allows attackers to reset passwords for arbitrary users, potentially leading to full account takeover.",
  "technicalDetails": "The vulnerability resides within the resetPass function of the UsersController.java file in the Tourism-Management-System. The root cause is a deficiency in the password recovery implementation that fails to adequately validate the legitimacy of recovery requests, leading to weak password recovery mechanisms.\nThe attack is remotely exploitable, allowing an actor to interface directly with the Password Recovery component without prior authentication. The execution flow typically involves an attacker crafting a request directed at the affected endpoint, which, due to the logic error within the resetPass method, fails to enforce stringent verification steps required for account password resets.\nBecause the system lacks appropriate checks or uses predictable identifiers during the password reset process, an attacker can manipulate the parameters in the reset request to trigger a password change for a targeted account. The lack of cryptographically secure tokens or properly verified reset credentials allows for the successful completion of the reset operation.\nThe vulnerable code in UsersController.java fails to ensure that the requestor is the authorized owner of the account being modified. Consequently, the application processes the reset request as legitimate, updating the user's password to a state defined by the attacker or resetting it in a way that allows the attacker to assume control.\nThis failure effectively bypasses standard account security controls. Post-exploitation, the attacker gains full access to the compromised account, which, depending on the role of the user (e.g., administrator), could lead to complete system compromise and data exfiltration.\nThe vulnerability affects all iterations of the software up to commit d984d172dceca907f8b447efbdb06dc233f7938d. Given the rolling release deployment model, users are advised to verify their current version status against the provided patch identifier to ensure the fix 9cb6215ac871f99a90cde763cf003e95ff282283 is successfully integrated into their environment."
}