This vulnerability occurs in the getOption function of CommonController.java. By manipulating the tableName and columnName arguments, an attacker can retrieve sensitive information beyond authorized boundaries. The flaw resides in insufficient validation and improper authorization checks, exposing the system to unfiltered data disclosure. The weakness aligns with information exposure (CWE-200) and authorization bypass (CWE-284).

The affected product is jaychouchannel’s Tourism-Management-System. No specific product releases are listed because the project follows a rolling‑release model. Until the patch identified by commit d44ec3aa0bd2a72c8800e3befb0a9a96a6491b86 is applied, all available builds remain vulnerable.

The CVSS score of 6.9 indicates a medium‑to‑high severity vulnerability. EPSS is not available, and the issue is not currently listed in CISA's KEV catalog, but the public disclosure and remote attack possibilities imply a tangible risk. An attacker could trigger the flaw through the exposed web API, possibly exposing confidential data without any special access. The lack of authentication or authorization gating makes exploitation straightforward for requesters able to reach the endpoint.