This vulnerability involves a SQL injection in the Hotel and Tourism Reservation software version 1.0 by code-projects. The issue is located in the /admin/add_tour.php file within the Tour Management Page component. An attacker can exploit the delete_image parameter to inject malicious SQL commands remotely without any privileges or user interaction. The vulnerability has been publicly disclosed, but no known exploits are reported in the wild. The CVSS 4.0 vector indicates network attack vector, low complexity, no privileges required, no user interaction, and low to limited impacts on confidentiality, integrity, and availability.

Successful exploitation could allow an attacker to execute arbitrary SQL commands on the backend database, potentially leading to unauthorized data access or modification. The impact is rated medium severity based on the CVSS 4.0 score of 6.9. There is no evidence of active exploitation in the wild at this time.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Since no official fix or workaround is provided, users should monitor vendor communications for updates. Until a patch is available, restricting access to the affected component and validating or sanitizing inputs on the delete_image parameter may reduce risk.