This vulnerability involves an SQL injection in the Hotel and Tourism Reservation System 1.0 by code-projects. The injection point is in the handling of the 'tour' GET parameter in the tour.php file. An attacker can remotely manipulate this parameter to inject malicious SQL commands, potentially leading to unauthorized data access or modification. The CVSS 4.0 base score is 6.9, reflecting medium severity with network attack vector, low attack complexity, no privileges or user interaction required, and low impact on confidentiality, integrity, and availability. The vulnerability was publicly disclosed on June 1, 2026, but no official patch or fix has been documented.

Successful exploitation could allow an unauthenticated remote attacker to execute arbitrary SQL commands on the backend database via the 'tour' GET parameter. This may lead to unauthorized data disclosure, modification, or other database impacts. The overall impact is rated medium due to low confidentiality, integrity, and availability impacts as per the CVSS vector. There are no confirmed reports of exploitation in the wild.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until an official fix is available, users should consider implementing input validation and parameterized queries as temporary mitigations to prevent SQL injection. Monitoring for unusual database queries related to the 'tour' parameter may also help detect attempted exploitation.