An unauthenticated remote code execution and account takeover vulnerability exists in the jaychouchannel Tourism-Management-System due to insecure password recovery implementation.

The application contains an unauthenticated password reset endpoint in the UsersController.java file that fails to verify user identity, instead setting a hardcoded password of 123456 for any username provided. This flaw also extends to the YonghuController and DaoyouController components, allowing an unauthenticated attacker to compromise any user account, including administrative accounts.

The vulnerability presents a critical risk to organizational data and system integrity. By resetting the password of administrative accounts, an attacker can gain full control over the management system, leading to unauthorized access to sensitive user data, potential manipulation of business records, and complete system compromise. Although the provided CVSS score is 7.3, the actual impact is effectively critical due to the ease of unauthorized administrative privilege escalation.

Immediate Action: Apply the vendor-provided patch (commit 9cb6215ac871f99a90cde763cf003e95ff282283) immediately to remove the vulnerable code and implement secure authentication requirements.

Proactive Monitoring: Review web server and application access logs for repeated requests to the /resetPass, /users/resetPass, or similar endpoints, particularly those originating from unknown or suspicious IP addresses.

Compensating Controls: Deploy a Web Application Firewall (WAF) rule to block or restrict access to the /resetPass, /users/resetPass, /YonghuController/resetPass, and /DaoyouController/resetPass endpoints to prevent unauthorized exploitation while the patch is being deployed.

Public Exploit Available: Yes, a functional proof-of-concept exists as documented in the researcher's GitHub issue report.

This vulnerability represents an extreme security risk due to the lack of required authentication and the predictable nature of the exploit. Organizations utilizing the jaychouchannel Tourism-Management-System must prioritize the immediate application of the referenced security patch. Failure to remediate this flaw leaves the entire system open to total compromise by any remote, unauthenticated actor.