This vulnerability exists in the getOption function of the file travel/src/main/java/com/controller/CommonController.java in the jaychouchannel Tourism-Management-System. By manipulating the input parameters tableName and columnName, an attacker can cause information disclosure remotely without any privileges or user interaction. The product follows a rolling release model, so no fixed version numbers are available. A patch has been identified by the commit hash d44ec3aa0bd2a72c8800e3befb0a9a96a6491b86. No vendor advisory or official remediation level is provided, and no known exploits are reported in the wild.

Successful exploitation allows an unauthenticated remote attacker to disclose sensitive information by manipulating input parameters. This could lead to exposure of confidential data handled by the Tourism-Management-System. The medium CVSS score reflects a moderate impact due to the information disclosure nature without direct integrity or availability impact.

A patch identified by commit d44ec3aa0bd2a72c8800e3befb0a9a96a6491b86 is recommended to remediate this vulnerability. Since the product uses a rolling release model, users should update to the latest version that includes this patch. No official vendor advisory or temporary workaround is provided, so applying the patch is the primary mitigation step.