CVE-2026-10290: code-projects Hotel and Tourism Reservation System GET Parameter tour.php sql injection
A weakness has been identified in code-projects Hotel and Tourism Reservation System 1.0. The affected element is an unknown function of the file tour.php of the component GET Parameter Handler. Executing a manipulation of the argument tour can lead to sql injection. The attack can be launched remotely. The exploit has been made available to the public and could be used for attacks.
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Configuration
Modify tour.php to properly validate and sanitize the GET parameter 'tour' and replace any concatenated SQL queries with parameterized queries (prepared statements) or equivalent safe API to eliminate SQL injection.
tour.php (GET parameter 'tour') input handling / SQL query construction = use prepared statements and validate/sanitize 'tour' input - Compensating control
Deploy a Web Application Firewall (WAF) or input-filtering rules to detect and block SQL injection attempts targeting the 'tour' parameter, and restrict external access to the application (e.g., via network ACLs) until code is remediated.
- Operational
Monitor application and database logs for indicators of exploitation against tour.php, investigate any suspicious activity, and if compromise is suspected, rotate database credentials and any affected secrets.
Event History
Frequently Asked Questions
What is the severity of CVE-2026-10290?
The severity of CVE-2026-10290 is classified as medium with a score of 5.5.
How do I fix CVE-2026-10290?
To fix CVE-2026-10290, sanitize all user inputs for the tour.php GET parameter to prevent SQL injection.
What type of attack does CVE-2026-10290 expose my system to?
CVE-2026-10290 exposes your system to SQL injection attacks which can lead to unauthorized data access.
What component is affected by CVE-2026-10290?
CVE-2026-10290 affects the GET Parameter Handler in the tour.php file of the Code-projects Hotel and Tourism Reservation System.
Is remote exploitation possible with CVE-2026-10290?
Yes, CVE-2026-10290 can be exploited remotely through manipulation of the tour argument.