An unauthenticated remote code modification vulnerability in the jaychouchannel Tourism-Management-System allows attackers to alter sensitive records without requiring any login credentials.

The application exposes multiple controllers (such as ForumController and ChatmessageController) with an /update endpoint that lacks authentication checks. This allows an unauthenticated remote attacker to pass malicious JSON payloads to the updateById function, leading to unauthorized data modification across twelve distinct system components.

Successful exploitation permits an attacker to perform unauthorized actions such as defacing website content, tampering with private chat records, and altering system settings. Given the CVSS score of 7.3 and the nature of the vulnerability, the impact is high, as it facilitates data integrity loss and potential reputational damage. The ability for an unauthenticated user to rewrite backend database records poses a severe threat to the confidentiality and integrity of the entire application.

Immediate Action: Apply the vendor-provided patch (commit 84d8ec384f669df3985293dab293bb7b477efa64) to the codebase immediately.

Proactive Monitoring: Review application access logs for unusual POST requests directed at /update endpoints from unauthorized IP addresses.

Compensating Controls: Deploy a Web Application Firewall (WAF) to block requests containing unauthorized JSON payloads targeting the /update path until the patch is implemented.

Public Exploit Available: Yes — a published proof-of-concept exists in the researcher's GitHub issue report.

The vulnerability represents a critical failure in access control that allows any remote user to manipulate data within the Tourism-Management-System. Organizations running this software must prioritize the application of the identified patch to prevent unauthorized record modification. Given that the exploit path is simple and publicly documented, delaying remediation significantly increases the risk of data compromise.