SQL Injection Vulnerability in Tourism-Management-System

A SQL injection vulnerability exists in the Tourism-Management-System repository maintained by jaychouchannel. The flaw resides within the CommonDao component, specifically inside the 'travel/src/main/java/com/controller/CommonController.java' file. An attacker can exploit this remotely by injecting malicious input into the 'table', 'column', 'xColumn', or 'yColumn' parameters. Because the application fails to properly sanitize these inputs before including them in SQL queries, an attacker can bypass authentication, exfiltrate sensitive data, or modify database contents.

Publicly available exploit code has been released, increasing the risk of exploitation. As the project does not utilize standard versioning, all instances running commits up to 8122bf020d91199eddfff3ee02d1632a70a9a132 are considered vulnerable. Security teams should prioritize patching the system using the official fix provided in commit d44ec3aa0bd2a72c8800e3befb0a9a96a6491b86.

Impact

Successful exploitation allows remote, unauthenticated attackers to perform SQL injection attacks. This can result in unauthorized access to sensitive application data, potential modification or deletion of records, and under certain configurations, escalation of privileges or administrative takeover of the backend database. All organizations hosting this system are at risk of data breaches and service disruption.

Recommendation

• Apply the security patch provided in commit d44ec3aa0bd2a72c8800e3befb0a9a96a6491b86 to all instances of the Tourism-Management-System.
• Audit access logs for abnormal HTTP requests containing SQL keywords (e.g., SELECT, UNION, SLEEP) targeting the CommonController endpoint.
• Enforce strict input validation on all parameters handled by CommonController.java.
• Monitor webserver traffic for incoming requests where the query parameters 'table', 'column', 'xColumn', or 'yColumn' contain suspicious SQL syntax or metacharacters.