The vulnerability is a classic SQL injection that occurs when the tour parameter in tour.php is not properly sanitized. Attackers can manipulate the argument to inject arbitrary SQL statements, enabling them to read, modify, or delete data from the underlying database. This flaw is classified under CWE‑74 (URL Manipulation) and CWE‑89 (SQL Injection). The impact is remote data compromise, potentially exposing sensitive customer information and altering reservation data. The flaw is confined to the code‑projects Hotel and Tourism Reservation System version 1.0, which includes a vulnerable GET parameter handler that accepts the tour argument without adequate encoding. Risk and Exploitability: The CVSS score of 6.9 indicates moderate severity. The EPSS score is not available, so the current likelihood of exploitation cannot be quantified. The vulnerability is not listed in CISA KEV, yet the exploit is publicly available on GitHub and VULDB, implying attackers can deploy it without difficulty. Attackers can reach the vulnerable endpoint remotely over HTTP, using a crafted tour parameter even without authentication.

Affected systems: The vulnerability affects the code‑projects Hotel and Tourism Reservation System version 1.0. The vulnerable component is the tour.php file's GET parameter handler that processes the tour argument without proper validation. The vulnerability has been identified in this specific release and no other versions were mentioned.

Risk and Exploitability: The CVSS score of 6.9 indicates moderate severity. The EPSS score is not available, so the current likelihood of exploitation cannot be quantified. The vulnerability is not listed in CISA KEV, yet the exploit is publicly available on GitHub and VULDB, implying attackers can deploy it without difficulty. Attackers can reach the vulnerable endpoint remotely over HTTP, using a crafted tour parameter even without authentication.