This vulnerability in code-projects Hotel and Tourism Reservation 1.0 involves SQL injection via the 'tour' parameter in the /admin/tour_reserves.php file of the Tour Reservations Page component. An attacker can remotely exploit this flaw without any privileges or user interaction. The vulnerability allows partial compromise of confidentiality, integrity, and availability. Although an exploit has been published, there is no vendor-provided patch or official remediation information available at this time.

Successful exploitation of this SQL injection vulnerability could allow an attacker to execute arbitrary SQL commands on the backend database, potentially leading to unauthorized data access, modification, or deletion. The impact affects confidentiality, integrity, and availability at a low to limited level as per the CVSS vector. No evidence of exploitation in the wild has been reported.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until an official fix is available, it is recommended to apply input validation and sanitization on the 'tour' parameter to mitigate SQL injection risks. Monitor for vendor updates regarding patches or official mitigations.