CVE-2026-10290: SQL Injection in Hotel Tourism Reservation System 1.0

Technical summary

CVE-2026-10290 is a SQL injection flaw (CWE-89) arising from improper neutralization of special elements in the tour parameter (CWE-74). The tour.php component fails to sanitize or parameterize user-supplied input before incorporating it into SQL queries. The attack vector is network-based with low attack complexity, requires no privileges or user interaction, and impacts the entire system scope. The CVSS v3.1 score of 7.3 (HIGH) reflects low confidentiality, integrity, and availability impact rather than complete compromise, but the availability of public exploits significantly elevates practical risk.

Business impact

Exploitation could enable attackers to exfiltrate customer data (reservations, contact information, payment details), modify or delete booking records, or disrupt reservation operations. Hotels and tourism platforms relying on this system may face service downtime, regulatory notification obligations under data protection laws, reputational damage, and potential financial liability. The public availability of exploits means attackers of varying sophistication may target vulnerable instances.

Affected systems

Code-Projects Hotel and Tourism Reservation System version 1.0 is confirmed vulnerable. Organizations should audit their environment to identify any instances of this software currently in production or development. No patch version data is provided in the source record; verify against the vendor's official security advisory for remediation availability and scope.

Exploitability

This vulnerability is highly exploitable in practical terms. Network accessibility eliminates physical barriers; no authentication is required; attack complexity is low, meaning a basic SQL injection payload will likely succeed; and public exploit code removes the technical barrier for opportunistic attackers. While the CVSS base score of 7.3 does not denote critical severity, the combination of remote exploitability, public tooling, and lack of KEV status (indicating no known active exploitation campaign tracked by CISA at publication) should not breed complacency—organizations must assume exploitation attempts are imminent or ongoing.

Remediation

Immediate action is required. First, consult the vendor's official security advisory to determine if a patched version is available and the recommended upgrade path. If no patch exists or upgrading is not feasible, implement network-level controls: restrict access to the affected application via firewall rules, WAF rules to block malicious tour parameter patterns, and database access controls. Conduct a forensic review of database logs and application logs to detect any prior exploitation. Implement input validation and parameterized queries if source code access and internal development resources are available.

Patch guidance

Check the vendor's official website and security advisories for patch availability and version numbers. Apply patches to the Hotel and Tourism Reservation System as soon as they are released and tested in a non-production environment. If the vendor does not provide a patch, escalate to product evaluation and consider migration to alternative, well-maintained reservation software. Document all patch deployment with timestamps and affected systems to demonstrate due diligence.

Detection guidance

Monitor web server and application logs for HTTP requests to tour.php containing suspicious characters in the tour parameter (SQL keywords, quotation marks, operators such as UNION, OR, or --). Deploy a WAF with rules to detect common SQL injection signatures. Database audit logs should be reviewed for unexpected queries, particularly those accessing sensitive tables or executing administrative commands. Network detection systems should flag repeated requests to tour.php from the same source, indicating scanning or exploitation attempts.

Why prioritize this

Although not yet listed in CISA's Known Exploited Vulnerabilities catalog, the public availability of exploits and the ease of exploitation (no authentication required, low complexity) make this a priority for immediate patch or mitigation. The high CVSS score and the sensitive nature of reservation data (personal information, payment details) justify urgent remediation. Organizations should treat this as critical-priority within their vulnerability management workflow, regardless of official KEV status.

Risk score, explained

The CVSS v3.1 score of 7.3 reflects the metric vector AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:L. The highest-impact components are network accessibility and lack of privilege/user interaction requirements, which enable remote attack at scale. The 'low' confidentiality, integrity, and availability impacts suggest partial rather than total compromise—likely reflecting that exploitation grants database read/modification access but not necessarily full system takeover. However, for a reservation system, partial database compromise can still expose hundreds of customer records and disrupt operations, warranting aggressive remediation timelines.

Frequently asked questions