An unauthenticated SQL injection vulnerability in the jaychouchannel Tourism-Management-System exposes the application to remote database manipulation and unauthorized data extraction.

The application utilizes unsafe MyBatis ${...} SQL interpolation within the CommonController, which processes unauthenticated URL path variables directly into SQL queries. This allows an unauthenticated remote attacker to inject malicious SQL syntax into database identifiers, such as table and column names, to bypass intended query logic.

Successful exploitation permits an attacker to perform unauthorized database operations, including the extraction of sensitive information via time-based blind SQL injection techniques. While the CVSS score of 7.3 reflects a high severity due to the lack of required authentication, the potential for unauthorized data disclosure poses a significant risk to data confidentiality and regulatory compliance.

Immediate Action: Apply the vendor-provided patch (commit d44ec3aa0bd2a72c8800e3befb0a9a96a6491b86) immediately to replace vulnerable string interpolation with secure, parameterized queries.

Proactive Monitoring: Review application access logs for unusual URL path structures or patterns indicative of SQL injection attempts, such as the use of sleep or union keywords within request paths.

Compensating Controls: Implement a Web Application Firewall (WAF) with rules configured to detect and block malicious SQL syntax within URL path parameters, providing a temporary layer of defense until patching is completed.

Public Exploit Available: Yes, a published proof-of-concept exists as documented in the GitHub issue tracker for the project.

The presence of a public proof-of-concept for this unauthenticated SQL injection vulnerability creates an urgent security risk. Organizations running this software must prioritize applying the identified patch immediately. If patching is not immediately feasible, restrict network access to the application and employ WAF filtering to mitigate the risk of remote exploitation.