EUVD-2026-72282
GHSA-3qqv-rr3f-4v86
Attack ChainAIDerived
Hypothetical attack flow derived from CVE metadata – not a confirmed exploit chain
-
AccessIdentify exposed CommonController HTTP endpoint
-
DeliveryInject SQL payload into table or column URL path segment
-
ExploitSend unauthenticated HTTP GET request
-
ExecutionUnsanitized identifier interpolated into SQL query
-
ImpactExtract or modify database records
Vulnerability Assessment
| Weakness |
CWE
OWASP Top 10:2025
A05:2025 - Injection
ASVS 5.0
V1 - Encoding and Sanitization Parameterized queries, prepared statements
MITRE ATT&CK
2 techniques across 2 tactics: Initial Access, Persistence The technique list with ATT&CK links and the kill-chain view is part of the Basic plan and up. |
| Exploitation Conditions | No authentication is required - the CVSS vector specifies PR:N, confirming the affected endpoints are accessible without credentials. Exploitation requires only network access to the application's HTTP port and the ability to control URL path segments, which any HTTP client can do. No special configuration, feature flag, or non-default deployment mode is required; the vulnerability is present in the default codebase across all endpoints that accept table or column name path variables. The primary limiting factor is the product's extremely narrow deployment footprint, as it is a student/hobby Java project unlikely to be exposed on public-facing infrastructure. |
| Impact | The CVSS 4.0 vector (AV:N/AC:L/AT:N/PR:N/UI:N/E:P) correctly characterizes this as remotely exploitable without authentication and with low attack complexity, with a proof-of-concept exploit already published. However, the impact metrics (VC:L/VI:L/VA:L) reflect limited database-scope consequences - not full system compromise - which the 6.9 score reasonably captures. Even a mid-sized municipal IT team in mielec would be unlikely to run this specific system, as it is a student-grade or hobby-grade application with negligible enterprise footprint, constraining real-world risk substantially. The absence of CISA KEV listing is consistent with the product's obscurity. The primary risk signals pushing urgency are PR:N (no auth barrier) and E:P (working exploit code public), while the mitigating signal is the product's near-zero production deployment base. |
| Exploit ScenarioDerived | An unauthenticated attacker sends a crafted HTTP GET request to a CommonController endpoint, substituting a SQL injection payload for the tableName or columnName URL path segment. The unsanitized identifier is interpolated directly into the SQL query via CommonDao, allowing enumeration of database schemas and extraction or modification of records. A working proof-of-concept demonstrating this technique is publicly available via GitHub issue #7 (https://github.com/jaychouchannel/Tourism_Management_System/issues/7). |
Get an e-mail when this CVE is exploited, patched or re-scored. Free account.
Alert meAnalysisAIv1 – Sep 07, 2026
SQL injection in jaychouchannel's Tourism-Management-System (Java Spring Boot, up to commit 8122bf02) allows unauthenticated remote attackers to manipulate SQL queries by injecting payloads into table, column, xColumn, or yColumn path variables accepted by multiple CommonController endpoints backed by CommonDao. Successful exploitation yields limited data disclosure and modification across the application database. A public proof-of-concept is available via GitHub issue #7, and a patch has been merged as commit d44ec3aa via PR #14.
RemediationAI
Apply upstream patch commit d44ec3aa0bd2a72c8800e3befb0a9a96a6491b86 or merge PR #14 (https://github.com/jaychouchannel/Tourism-Management-System/pull/14), which introduces SqlIdentifierValidator to validate all table and column identifier path variables before SQL execution. No formally released tagged version exists; the fix is confirmed at the commit level only. If patching is not immediately feasible, restrict network access to the CommonController API endpoints - particularly those accepting table/column path variables such as /option/, /follow/, /remind/, /cal/, /group/, and /value/ - to trusted internal networks using firewall rules or a reverse proxy. A WAF rule blocking SQL metacharacters in URL path segments can reduce exposure but is not a substitute for the code fix, as identifier-based injection may bypass naive pattern matching.
Affected VersionsENISA
Affects your stack
Find out whether the stacks and servers you run are on an affected version.
Checking this CVE against your own stacks and servers is part of the Basic plan and up.
Technical ContextAI · show details
The affected component is CommonController.java in a Java Spring Boot application. Multiple REST endpoints-getOption, getFollowByOption, remindCount, cal, group, value, and related handlers-accept dynamic table and column identifiers as URL path variables (e.g., /option/{tableName}/{columnName}) and pass them unsanitized into SQL query construction via CommonDao. CWE-89 (SQL Injection) describes the root cause: user-supplied string identifiers are interpolated directly into SQL statements without parameterization or allowlist validation. The patch (PR #14, commit d44ec3aa) introduces a new SqlIdentifierValidator utility class (replacing the CommonUtil import) that validates table and column name identifiers against an explicit allowlist before any query execution, closing all affected call sites in the controller.
Know when Java gets its next vulnerability
- Watch products and get an email when something new is published
- Check this CVE against your own stack and servers
- Exploit and PoC references, threat intelligence from 22 sources
No credit card · 7-day full trial
Severity by source
CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:L/VI:L/VA:L/SC:N/SI:N/SA:N/E:P
Network-accessible unauthenticated endpoints expose SQL-injectable path variables; impact limited to low C/I/A consistent with partial database read/write, no scope change.
Primary rating from Vendor (VulDB).
CVSS VectorVendor: VulDB
Lifecycle Timeline
2DescriptionCVE.org
A weakness has been identified in jaychouchannel Tourism-Management-System up to 8122bf020d91199eddfff3ee02d1632a70a9a132. Affected is an unknown function of the file travel/src/main/java/com/controller/CommonController.java of the component CommonDao. Executing a manipulation of the argument table/column/xColumn/yColumn can lead to sql injection. The attack can be launched remotely. The exploit has been made available to the public and could be used for attacks. This product does not use versioning. This is why information about affected and unaffected releases are unavailable. This patch is called d44ec3aa0bd2a72c8800e3befb0a9a96a6491b86. A patch should be applied to remediate this issue.
Threat Intelligence Overview
NVD
CVE.org
EPSS
Vulnrichment
VulDB
How this decision was reached
The engine reads each signal below and applies a fixed list of rules from top to bottom. The first rule that matches sets the recommended action – like a statement, every line is shown.
What every action level means
SSVC AssessmentENISA
Priority Score
Attack Technique
SQL injection exploits the way applications construct database queries by mixing user input directly into SQL statements.
Oracle Java SE 7 Update 6 and earlier contains multiple sandbox bypass vulnerabilities via the ClassFinder and forName m
Remote code execution in IBM Sterling B2B Integrator, Sterling Integrator, and Tivoli Common Reporting allows unauthenti
Java Runtime Environment sandbox bypass via incorrect image channel verification in 2D component allows remote unauthent
Oracle Java SE JDK/JRE 7 and 6 Update 27 and earlier allows remote code execution with complete system compromise throug
JBoss Seam 2 in Red Hat JBoss EAP 4.3.0 fails to sanitize JBoss Expression Language inputs, allowing remote attackers to
Unspecified vulnerability in the Java Runtime Environment (JRE) component in Oracle Java SE 7 update 4 and earlier, 6 up
Multiple vulnerabilities in Oracle Java 7 before Update 11 allow remote attackers to execute arbitrary code by (1) using
Unspecified vulnerability in the Java Runtime Environment (JRE) component in Oracle Java SE 7 Update 2 and earlier, 6 Up
The WLS Security component in Oracle WebLogic Server 10.3.6.0, 12.1.2.0, 12.1.3.0, and 12.2.1.0 allows remote attackers
Unspecified vulnerability in the Java Runtime Environment (JRE) component in Oracle Java SE 7 Update 7 and earlier allow
Remote unauthenticated attackers can execute arbitrary code on Adobe ColdFusion servers through Java deserialization fla
The ExceptionDelegator component in Apache Struts before 2.2.3.1 interprets parameter values as OGNL expressions during
Exploit-DB