Tourism Management System
Monthly
Missing authentication on update endpoints in jaychouchannel's Tourism-Management-System exposes write operations across 12 Spring controllers - including chat messages, forum posts, hotel/restaurant discussions, news, friend links, and bookmarks - to unauthenticated remote attackers. The root cause is confirmed by the patch commit (84d8ec3): the custom `@IgnoreAuth` annotation was incorrectly applied to update-path handlers, causing the authentication interceptor to skip those routes entirely. A public proof-of-concept exists via GitHub Issue #11; no CISA KEV listing has been issued.
Unauthenticated remote attackers can register accounts with elevated (administrator) privileges in jaychouchannel Tourism-Management-System by manipulating the UsersEntity parameter during registration, bypassing role assignment controls. The commit diff reveals a broader scope than the description implies: at least 12 controller classes (ChatmessageController, multiple Discuss* controllers, ForumController, FriendController, FriendlinkController, NewsController, NewstypeController, StoreupController) had security() endpoints decorated with @IgnoreAuth, making those endpoints callable without any authentication. Publicly available exploit code exists; no active exploitation confirmed in CISA KEV.
Authorization bypass in jaychouchannel's Tourism-Management-System allows authenticated remote users to access or modify ticket order records belonging to other users by manipulating the ID parameter in CRUD operations against MenpiaodingdanController.java. This is a classic Insecure Direct Object Reference (IDOR) pattern where the application fails to verify that the requesting user owns the referenced resource. A publicly available proof-of-concept exists (GitHub issue #9), and a patch has been committed (d44ec3aa0bd2a72c8800e3befb0a9a96a6491b86), though no versioned release is available due to the project's rolling-release approach.
Authorization bypass in jaychouchannel's Tourism-Management-System (all Java/Spring Boot commits through 84d8ec384f) allows low-privileged authenticated users to invoke protected `security()` endpoints across 12 controllers by exploiting misapplied `@IgnoreAuth` annotations that instruct the AuthorizationInterceptor to skip permission enforcement entirely. The affected endpoints span chat, discussion, forum, friend, news, and store-bookmark controllers, exposing user security data and privileged actions to callers who lack the required roles. Publicly available exploit code exists via GitHub issue #12; the vendor has released a patch commit removing the offending annotations.
SQL injection in jaychouchannel's Tourism-Management-System (Java Spring Boot, up to commit 8122bf02) allows unauthenticated remote attackers to manipulate SQL queries by injecting payloads into table, column, xColumn, or yColumn path variables accepted by multiple CommonController endpoints backed by CommonDao. Successful exploitation yields limited data disclosure and modification across the application database. A public proof-of-concept is available via GitHub issue #7, and a patch has been merged as commit d44ec3aa via PR #14.
A security flaw has been discovered in PHPGurukul Tourism Management System 1.0. Rated medium severity (CVSS 6.9), this vulnerability is remotely exploitable, no authentication required, low attack complexity. Public exploit code available and no vendor patch available.
A Shell Upload vulnerability in Tourism Management System 2.0 allows an attacker to upload and execute arbitrary PHP shell scripts on the server, leading to remote code execution and unauthorized. Rated high severity (CVSS 7.2), this vulnerability is remotely exploitable, low attack complexity. Public exploit code available and no vendor patch available.
A vulnerability was found in code-projects Tourism Management System 1.0 and classified as critical. Rated medium severity (CVSS 4.8), this vulnerability is low attack complexity. Public exploit code available and no vendor patch available.
A vulnerability has been found in code-projects Tourism Management System 1.0 and classified as critical. Rated medium severity (CVSS 4.8), this vulnerability is low attack complexity. Public exploit code available and no vendor patch available.
A vulnerability, which was classified as problematic, was found in code-projects Tourism Management System 1.0. Rated medium severity (CVSS 5.3), this vulnerability is remotely exploitable, low attack complexity. Public exploit code available and no vendor patch available.
A reflected cross-site scripting (XSS) vulnerability in Phpgurukul Tourism Management System v2.0 allows attackers to execute arbitrary code in the context of a user's browser via injecting a crafted. Rated medium severity (CVSS 6.1), this vulnerability is remotely exploitable, no authentication required, low attack complexity. Public exploit code available and no vendor patch available.
Phpgurukul Tourism Management System v2.0 is vulnerable to Unrestricted Upload of File with Dangerous Type via /tms/admin/change-image.php. Rated high severity (CVSS 8.1), this vulnerability is remotely exploitable, low attack complexity. Public exploit code available and no vendor patch available.
Phpgurukul Tourism Management System v2.0 is vulnerable to Unrestricted Upload of File with Dangerous Type via tms/admin/create-package.php. Rated high severity (CVSS 8.8), this vulnerability is remotely exploitable, low attack complexity. Public exploit code available and no vendor patch available.
A vulnerability classified as problematic has been found in PHPGurukul Tourism Management System 1.0. Rated medium severity (CVSS 6.1), this vulnerability is remotely exploitable, no authentication required, low attack complexity. No vendor patch available.
Tourism Management System Version: V 3.2 is affected by: Cross Site Request Forgery (CSRF). Rated medium severity (CVSS 4.3), this vulnerability is remotely exploitable, no authentication required, low attack complexity. Public exploit code available and no vendor patch available.
An Arbitrary File Upload is discovered in SourceCodester Tourism Management System 1.0 allows the user to conduct remote code execution via admin/create-package.php vulnerable page. Rated high severity (CVSS 8.8), this vulnerability is remotely exploitable, low attack complexity. Public exploit code available and no vendor patch available.
Missing authentication on update endpoints in jaychouchannel's Tourism-Management-System exposes write operations across 12 Spring controllers - including chat messages, forum posts, hotel/restaurant discussions, news, friend links, and bookmarks - to unauthenticated remote attackers. The root cause is confirmed by the patch commit (84d8ec3): the custom `@IgnoreAuth` annotation was incorrectly applied to update-path handlers, causing the authentication interceptor to skip those routes entirely. A public proof-of-concept exists via GitHub Issue #11; no CISA KEV listing has been issued.
Unauthenticated remote attackers can register accounts with elevated (administrator) privileges in jaychouchannel Tourism-Management-System by manipulating the UsersEntity parameter during registration, bypassing role assignment controls. The commit diff reveals a broader scope than the description implies: at least 12 controller classes (ChatmessageController, multiple Discuss* controllers, ForumController, FriendController, FriendlinkController, NewsController, NewstypeController, StoreupController) had security() endpoints decorated with @IgnoreAuth, making those endpoints callable without any authentication. Publicly available exploit code exists; no active exploitation confirmed in CISA KEV.
Authorization bypass in jaychouchannel's Tourism-Management-System allows authenticated remote users to access or modify ticket order records belonging to other users by manipulating the ID parameter in CRUD operations against MenpiaodingdanController.java. This is a classic Insecure Direct Object Reference (IDOR) pattern where the application fails to verify that the requesting user owns the referenced resource. A publicly available proof-of-concept exists (GitHub issue #9), and a patch has been committed (d44ec3aa0bd2a72c8800e3befb0a9a96a6491b86), though no versioned release is available due to the project's rolling-release approach.
Authorization bypass in jaychouchannel's Tourism-Management-System (all Java/Spring Boot commits through 84d8ec384f) allows low-privileged authenticated users to invoke protected `security()` endpoints across 12 controllers by exploiting misapplied `@IgnoreAuth` annotations that instruct the AuthorizationInterceptor to skip permission enforcement entirely. The affected endpoints span chat, discussion, forum, friend, news, and store-bookmark controllers, exposing user security data and privileged actions to callers who lack the required roles. Publicly available exploit code exists via GitHub issue #12; the vendor has released a patch commit removing the offending annotations.
SQL injection in jaychouchannel's Tourism-Management-System (Java Spring Boot, up to commit 8122bf02) allows unauthenticated remote attackers to manipulate SQL queries by injecting payloads into table, column, xColumn, or yColumn path variables accepted by multiple CommonController endpoints backed by CommonDao. Successful exploitation yields limited data disclosure and modification across the application database. A public proof-of-concept is available via GitHub issue #7, and a patch has been merged as commit d44ec3aa via PR #14.
A security flaw has been discovered in PHPGurukul Tourism Management System 1.0. Rated medium severity (CVSS 6.9), this vulnerability is remotely exploitable, no authentication required, low attack complexity. Public exploit code available and no vendor patch available.
A Shell Upload vulnerability in Tourism Management System 2.0 allows an attacker to upload and execute arbitrary PHP shell scripts on the server, leading to remote code execution and unauthorized. Rated high severity (CVSS 7.2), this vulnerability is remotely exploitable, low attack complexity. Public exploit code available and no vendor patch available.
A vulnerability was found in code-projects Tourism Management System 1.0 and classified as critical. Rated medium severity (CVSS 4.8), this vulnerability is low attack complexity. Public exploit code available and no vendor patch available.
A vulnerability has been found in code-projects Tourism Management System 1.0 and classified as critical. Rated medium severity (CVSS 4.8), this vulnerability is low attack complexity. Public exploit code available and no vendor patch available.
A vulnerability, which was classified as problematic, was found in code-projects Tourism Management System 1.0. Rated medium severity (CVSS 5.3), this vulnerability is remotely exploitable, low attack complexity. Public exploit code available and no vendor patch available.
A reflected cross-site scripting (XSS) vulnerability in Phpgurukul Tourism Management System v2.0 allows attackers to execute arbitrary code in the context of a user's browser via injecting a crafted. Rated medium severity (CVSS 6.1), this vulnerability is remotely exploitable, no authentication required, low attack complexity. Public exploit code available and no vendor patch available.
Phpgurukul Tourism Management System v2.0 is vulnerable to Unrestricted Upload of File with Dangerous Type via /tms/admin/change-image.php. Rated high severity (CVSS 8.1), this vulnerability is remotely exploitable, low attack complexity. Public exploit code available and no vendor patch available.
Phpgurukul Tourism Management System v2.0 is vulnerable to Unrestricted Upload of File with Dangerous Type via tms/admin/create-package.php. Rated high severity (CVSS 8.8), this vulnerability is remotely exploitable, low attack complexity. Public exploit code available and no vendor patch available.
A vulnerability classified as problematic has been found in PHPGurukul Tourism Management System 1.0. Rated medium severity (CVSS 6.1), this vulnerability is remotely exploitable, no authentication required, low attack complexity. No vendor patch available.
Tourism Management System Version: V 3.2 is affected by: Cross Site Request Forgery (CSRF). Rated medium severity (CVSS 4.3), this vulnerability is remotely exploitable, no authentication required, low attack complexity. Public exploit code available and no vendor patch available.
An Arbitrary File Upload is discovered in SourceCodester Tourism Management System 1.0 allows the user to conduct remote code execution via admin/create-package.php vulnerable page. Rated high severity (CVSS 8.8), this vulnerability is remotely exploitable, low attack complexity. Public exploit code available and no vendor patch available.