CVE-2026-86282: SQL Injection in jaychouchannel Tourism-Management-System

This vulnerability in the jaychouchannel Tourism-Management-System allows remote attackers to perform SQL injection by manipulating input parameters related to database table and column names in the CommonController.java file's CommonDao component. The lack of product versioning prevents precise identification of affected versions. The vulnerability has a CVSS 4.0 base score of 6.9 (medium severity), indicating it is remotely exploitable without privileges or user interaction but with limited impact on confidentiality, integrity, and availability. A patch exists identified by commit d44ec3aa0bd2a72c8800e3befb0a9a96a6491b86 and should be applied to fix the issue.

Successful exploitation can lead to SQL injection attacks, potentially allowing attackers to manipulate or access the backend database. The CVSS score indicates limited impact on confidentiality, integrity, and availability, but the vulnerability is remotely exploitable without authentication or user interaction. Public exploit code availability increases the risk of exploitation, although no active exploitation is currently known.

A patch identified by commit d44ec3aa0bd2a72c8800e3befb0a9a96a6491b86 is available and should be applied to remediate this vulnerability. Since the product does not use versioning, ensure the patch is applied to the affected deployment. No additional vendor advisory information is available, so check the vendor's resources for updated remediation guidance.