The vulnerability resides in CommonController.java of the CommonDao component of the open-source Tourism-Management-System. A flaw in the handling of parameters such as table, column, xColumn, and yColumn allows an attacker to inject arbitrary SQL into the database query. Because the application forwards the constructed SQL without sanitizing the input, an attacker can read, modify, or delete data in the underlying database. This can compromise the confidentiality, integrity, and availability of the system's data.

The affected product is the Tourism-Management-System published by jaychouchannel. All releases built from code before the patch commit d44ec3aa0bd2a72c8800e3befb0a9a96a6491b86 are considered vulnerable. Because the project does not use explicit versioning, any deployment based on code older than this commit remains at risk.

The CVSS score of 6.9 indicates a high-impact vulnerability that requires network access to exploit. The EPSS score is unavailable, but a public proof-of-concept has been released, raising the likelihood of exploitation. Since the attack can be launched remotely by manipulating query parameters directed at CommonController endpoints, the risk is significant for exposed servers. Although the vulnerability is not listed in the CISA KEV catalog, the presence of publicly available exploits means attackers can easily target vulnerable instances over the internet.