CVE-2026-10290: Hotel Tourism Reservation SQLi Vulnerability

CVE-2026-10290 Overview

CVE-2026-10290 is an unauthenticated SQL injection vulnerability in code-projects Hotel and Tourism Reservation System 1.0. The flaw resides in the tour.php file, where the tour GET parameter is passed to a backend database query without proper sanitization. Remote attackers can manipulate the parameter to inject arbitrary SQL statements against the application database. A public proof-of-concept is available on GitHub, lowering the barrier for opportunistic exploitation. The vulnerability is categorized under [CWE-74] (Improper Neutralization of Special Elements in Output Used by a Downstream Component).

Critical Impact
Unauthenticated attackers can extract, modify, or destroy reservation and customer data stored in the application database through remote SQL injection against the tour parameter.

Affected Products

code-projects Hotel and Tourism Reservation System 1.0
Vulnerable component: tour.php (GET Parameter Handler)
Vulnerable parameter: tour

Discovery Timeline

2026-06-01 - CVE-2026-10290 published to NVD
2026-06-02 - Last updated in NVD database

Technical Details for CVE-2026-10290

Vulnerability Analysis

The vulnerability exists in tour.php, a script that handles tour listing or detail requests in the Hotel and Tourism Reservation System. The application accepts a user-supplied tour value via the HTTP GET query string and concatenates it directly into a SQL statement. Because no parameterization, prepared statements, or input validation is applied, attacker-controlled input is interpreted as SQL syntax by the backend database engine.

The attack requires no authentication and no user interaction. A single crafted HTTP request to the vulnerable endpoint is sufficient to trigger the flaw. Public exploit code is hosted on GitHub, making this a low-effort target for automated scanning.

Root Cause

The root cause is missing input neutralization in the GET parameter handler of tour.php. The tour argument flows from the request directly into a dynamically constructed SQL query. This is a textbook violation of secure coding guidance that mandates the use of prepared statements or parameterized queries for all database access.

Attack Vector

An attacker reaches the vulnerable endpoint over the network by issuing an HTTP GET request to tour.php with a malicious payload in the tour parameter. Typical payloads use SQL syntax such as boolean conditions, UNION SELECT clauses, or stacked queries to enumerate database structure and exfiltrate records. Time-based and error-based techniques can be used when output is not directly reflected. Automated tools such as sqlmap can fully weaponize the flaw with minimal operator effort.

For technical details, see the GitHub PoC for SQL Injection and the VulDB CVE-2026-10290 entry.

Detection Methods for CVE-2026-10290

Indicators of Compromise

HTTP GET requests to tour.php containing SQL metacharacters such as ', ", --, ;, UNION, SELECT, or SLEEP( in the tour parameter.
Web server access logs showing repeated requests to tour.php?tour= from a single source with progressively varying payloads.
Database error messages or HTTP 500 responses correlated with requests to tour.php.
User-Agent strings associated with automated tools such as sqlmap, nikto, or wfuzz.

Detection Strategies

Deploy a Web Application Firewall (WAF) rule set, such as OWASP CRS, to flag SQL injection signatures targeting the tour parameter.
Implement server-side logging of all query strings reaching tour.php and alert on payloads matching SQL injection patterns.
Monitor database query logs for anomalous statements referencing information_schema, mysql.user, or other sensitive system tables.

Monitoring Recommendations

Forward web server and database logs to a centralized analytics platform for correlation and retention.
Establish baseline request patterns for tour.php and alert on deviations in volume or payload structure.
Track outbound data volumes from the database host to detect bulk extraction attempts.

How to Mitigate CVE-2026-10290

Immediate Actions Required

Restrict public exposure of the Hotel and Tourism Reservation System until a fix is applied; place it behind authentication or VPN access where feasible.
Deploy WAF rules that block SQL injection payloads targeting tour.php and the tour parameter.
Audit web and database logs for prior exploitation attempts and rotate any credentials that may have been stored in the database.
Review database user privileges and apply least-privilege principles to the web application's database account.

Patch Information

No official vendor patch has been published in the referenced advisories. Administrators should monitor the Code Projects Resource Hub for updates. Until a fix is released, source-level remediation requires replacing string concatenation in tour.php with parameterized queries (for example, PDO prepared statements in PHP) and applying strict server-side validation on the tour parameter.

Workarounds

Apply WAF or reverse-proxy filtering to reject requests where tour is non-numeric or contains SQL metacharacters.
Modify tour.php to cast the tour value to an integer before use, for example $tour = (int)$_GET['tour'];, if the parameter is expected to be a numeric identifier.
Disable the affected endpoint if the tour browsing feature is not in active use.
Configure the database account used by the application with read-only access to only the tables required for normal operation.

bash

# Example Apache mod_rewrite rule to block non-numeric tour values
RewriteEngine On
RewriteCond %{QUERY_STRING} (^|&)tour=([^0-9&]+) [NC]
RewriteRule ^tour\.php$ - [F,L]