This vulnerability allows an unauthenticated remote attacker to perform SQL injection by manipulating the 'tour' parameter in the /admin/tour_reserves.php file of code-projects Hotel and Tourism Reservation 1.0. The injection flaw could allow partial compromise of the database confidentiality, integrity, and availability as indicated by the CVSS vector (VC:L, VI:L, VA:L). The exploit code has been published, increasing the risk of exploitation. No vendor remediation or patch has been documented at this time.

Successful exploitation can lead to unauthorized access and modification of the backend database through SQL injection, potentially exposing sensitive reservation data or allowing data manipulation. The CVSS score of 6.9 (medium) reflects limited but significant impact on confidentiality, integrity, and availability. The vulnerability is remotely exploitable without authentication, increasing exposure.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until an official fix is available, it is recommended to implement web application firewall (WAF) rules to detect and block SQL injection attempts targeting the 'tour' parameter in /admin/tour_reserves.php. Restricting access to the admin interface and input validation/sanitization may reduce risk but are not complete mitigations.