CVE-2026-10290
Description
SQL injection vulnerability in Hotel and Tourism Reservation System 1.0 allows remote attackers to manipulate database data via the tour parameter.
AI Insight
LLM-synthesized narrative grounded in this CVE's description and references.
SQL injection vulnerability in Hotel and Tourism Reservation System 1.0 allows remote attackers to manipulate database data via the tour parameter.
Vulnerability
A SQL injection vulnerability exists in the tour.php file of the code-projects Hotel and Tourism Reservation System version 1.0. The tour GET parameter is directly incorporated into a raw SQL query without sanitization, prepared statements, or input validation, making it susceptible to manipulation [2].
Exploitation
An unauthenticated remote attacker can exploit this vulnerability by manipulating the tour GET parameter in the tour.php file. By injecting SQL metacharacters, such as a single quote, an attacker can break the intended SQL query. Further exploitation can be achieved using payloads to extract, modify, or delete database data [2].
Impact
Successful exploitation allows an unauthenticated remote attacker to perform arbitrary SQL operations, including reading sensitive data, modifying existing data, or deleting data from the database. This can lead to a complete compromise of the database integrity and confidentiality [2].
Mitigation
As of the available references, no patched version or specific mitigation has been disclosed. The vulnerability was confirmed by a full database dump using sqlmap [2]. The vendor URL is provided for potential updates [2].
AI Insight generated on Jun 1, 2026. Synthesized from this CVE's description and the cited reference URLs; citations are validated against the source bundle.
Affected products
1- Range: =1.0
Patches
0No patches discovered yet.
Vulnerability mechanics
Root cause
"The 'tour' GET parameter is directly interpolated into a raw SQL query without sanitization or prepared statements."
Attack vector
An unauthenticated remote attacker can exploit this vulnerability by manipulating the 'tour' GET parameter in the tour.php file. By injecting SQL metacharacters, such as a single quote, an attacker can break the intended SQL query. Further manipulation with payloads like ' or 1=1 -- - can lead to successful SQL injection, allowing for data extraction or modification [ref_id=1].
Affected code
The vulnerability resides in the tour.php file, specifically within the handling of the 'tour' GET parameter. The code directly assigns the value of $_GET['tour'] to the $tourID variable and then interpolates this variable into a raw SQL query: "SELECT * FROM tourism WHERE id = '{$tourID}' " [ref_id=1].
What the fix does
The advisory indicates that the fix involves using prepared statements instead of direct query interpolation. This approach separates the SQL code from the user-supplied data, preventing malicious input from being interpreted as SQL commands. The example shows preparing a statement with a placeholder and binding the user input to it, ensuring data integrity [ref_id=1].
Preconditions
- authNo authentication is required to exploit this vulnerability.
- networkThe attack can be launched remotely.
Reproduction
Setup: Install Hotel and Tourism Reservation System 1.0 on XAMPP and access at http://<target>/ht/ Step 1 — Visit any tour page as an unauthenticated user: http://<target>/ht/tour.php?tour=4 Step 2 — Inject a single quote to break the SQL query and confirm the vulnerability: http://<target>/ht/tour.php?tour=' Result: Fatal MySQL error is thrown — confirming unsanitized input reaches the SQL query. Step 3 — Confirm SQLi with a boolean-based payload: http://<target>/ht/tour.php?tour=' or 1=1 -- - Result: Page loads normally with tour data — boolean injection successful. Step 4 — Dump the entire database using sqlmap: sqlmap -r sqli.txt --dump --batch Result: sqlmap successfully dumps all tables in hotel_db including users, rooms, tour_reserves, gallery — full database compromise confirmed. [ref_id=1]
Generated on Jun 1, 2026. Inputs: CWE entries + fix-commit diffs from this CVE's patches. Citations validated against bundle.
References
5News mentions
0No linked articles in our index yet.