The vulnerability is an SQL injection in the 'tour' argument of the Tour Reservations Page in version 1.0 of code-projects Hotel and Tourism Reservation. The flaw allows an attacker to inject arbitrary SQL statements through the 'tour' parameter in /admin/tour_reserves.php, which can be triggered remotely. Published exploit code exists, enabling potential unauthorized database access, data disclosure, or modification. This flaw represents a classic SQL injection, falling under CWE-74 and CWE-89.

The affected product is code-projects Hotel and Tourism Reservation version 1.0, specifically the Tour Reservations Page component accessed via /admin/tour_reserves.php. No other product versions or vendors are listed as affected based on CNA data.

The CVSS score of 6.9 classifies the issue as medium severity. The EPSS score is less than 1%, indicating a very low probability of exploitation. The vulnerability is not listed in the CISA KEV catalog. Attack code has been published and the flaw can be triggered remotely, implying that a threat actor could craft a request to the vulnerable endpoint from any network location capable of reaching the host. Remote access increases the potential for exploitation under the right circumstances, though the actual exploitation likelihood remains low.