VULNpocalypse

CVE-2026-86284: jaychouchannel Tourism-Management-System CommonController.java getOption information disclosure

Advisory generated from the CVE record, CISA, Exploit Observer and VEDAS: what it is, whether it is exploited, who is affected, and how to fix and detect it.

Generated by VEDAS. Scores as of 2026-11-04 15:41 UTC. Rebuilt every few hours from cve-scores, CISA KEV and vedas-signatures. How this works and its limits.

What it is

A security vulnerability has been detected in jaychouchannel Tourism-Management-System up to 8122bf020d91199eddfff3ee02d1632a70a9a132. Affected by this vulnerability is the function getOption of the file travel/src/main/java/com/controller/CommonController.java. The manipulation of the argument tableName/columnName leads to information disclosure. The attack may be initiated remotely. The exploit has been disclosed publicly and may be used. This product uses a rolling release model to deliver continuous updates. As a result, specific version information for affected or updated releases is not available. The identifier of the patch is d44ec3aa0bd2a72c8800e3befb0a9a96a6491b86. To fix this issue, it is recommended to deploy a patch.

Description quoted from the CVE record (assigned by VulDB, published 2026-09-07).

Weakness: Information Disclosure; Improper Access Controls

How it can be exploited

Exploitable over the network with low attack complexity with no special attack requirements needing no privileges and no user interaction. Impact: confidentiality low, integrity none, availability none. CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:L/VI:N/VA:N/SC:N/SI:N/SA:N/E:P

CISA assessment (SSVC): CISA assesses that a public proof of concept exists. Automatable: yes. Technical impact: partial.

Public exploit evidence (Exploit Observer)

Exploit Observer found 5 code repositories naming this CVE.

Code repositories that name a CVE are often scanners, copies or fakes, and some are malware. Read the code before running anything.

See all 8 references on Exploit Observer

Live scores

EPSS
0.005
low predicted chance of attack
VEDAS
0.986
strong exploit evidence
On CISA KEV
Not listed
Detection rule
Nuclei · Suricata

Who is affected

ProductAffectedNot affected
jaychouchannel Tourism-Management-Systemversion 8122bf020d91199eddfff3ee02d1632a70a9a132Not stated

Version ranges exactly as the CVE record states them. “Before X” means X is the first fixed version.

How to fix it

Vendor guidance:

How to detect it

Nuclei template (active check)

Tourism-Management-System - SQL Injection via getOption

jaychouchannel Tourism-Management-System (travel) exposes CommonController.getOption at /option/{tableName}/{columnName}, annotated @IgnoreAuth, and interpolates the tableName and columnName path segments directly into a `SELECT DISTINCT <columnName> FROM <tableName>` query before the SqlIdentifierValidator allow-list was introduced. An unauthenticated attacker can inject arbitrary SQL through these identifiers to read database contents. This template injects a MySQL md5() expression evaluated over information_schema.tables and confirms the known hash of 999999999 is reflected in the response, proving unauthenticated SQL execution.

Name and description quoted from the template, written by VEDAS.

The template sends 1 request (GET /option/information_schema.tables/md5(999999999)); it decides using status, word matchers. Severity in the template: high. Marked as not yet verified against a live vulnerable target.

Run it against a host you own or are authorised to test:

bash
nuclei -u https://your-host -t CVE-2026-86284.yaml
Show the template (40 lines)
yaml
id: CVE-2026-86284

info:
  name: "Tourism-Management-System - SQL Injection via getOption"
  author: vedas-arpsyndicate
  severity: high
  description: |
    jaychouchannel Tourism-Management-System (travel) exposes CommonController.getOption at
    /option/{tableName}/{columnName}, annotated @IgnoreAuth, and interpolates the tableName and
    columnName path segments directly into a `SELECT DISTINCT <columnName> FROM <tableName>` query
    before the SqlIdentifierValidator allow-list was introduced. An unauthenticated attacker can
    inject arbitrary SQL through these identifiers to read database contents. This template injects
    a MySQL md5() expression evaluated over information_schema.tables and confirms the known hash of
    999999999 is reflected in the response, proving unauthenticated SQL execution.
  reference:
    - https://www.exploit.observer/?keyword=CVE-2026-86284&match=exact
    - https://subdomain.center/?engine=ammonites&keyword=tourism-management-system&match=exact
  classification:
    cvss-metrics: CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:N/VA:N/SC:N/SI:N/SA:N
    cvss-score: 8.7
    cve-id: CVE-2026-86284
    cwe-id: CWE-89
  metadata:
    verified: false
  tags: cve,cve2026,tourism-management-system,sqli,unauth

http:
  - method: GET
    path:
      - "{{BaseURL}}/option/information_schema.tables/md5(999999999)"

    matchers-condition: and
    matchers:
      - type: status
        status:
          - 200
      - type: word
        part: body
        words:
          - "c8c605999f3d8352d7bb792cf3fdb25b"

CVE-2026-86284.yaml on GitHub

Suricata rules (network detection)

1 rule that alert on traffic matching this exploit: VEDAS CVE-2026-86284 Tourism-Management-System - SQL Injection via getOption. Add them to your Suricata rule set and reload.

Show the rules
suricata
alert http $EXTERNAL_NET any -> $HTTP_SERVERS $HTTP_PORTS (msg:"VEDAS CVE-2026-86284 Tourism-Management-System - SQL Injection via getOption"; flow:established,to_server; http.method; content:"GET"; http.uri; content:"/option/"; fast_pattern; nocase; pcre:"/\/option\/[^\/]*(information_schema|select|concat|md5|union|sleep|updatexml|extractvalue|\x28)/i"; classtype:web-application-attack; reference:cve,CVE-2026-86284; reference:url,https://www.exploit.observer/?keyword=CVE-2026-86284&match=exact; reference:url,https://subdomain.center/?engine=ammonites&keyword=tourism-management-system&match=exact; sid:1086201; rev:1;)

CVE-2026-86284.rules on GitHub

References

Vendor advisories and patches

Exploit code

Technical analysis and advisories

Other references

Other databases

Where this comes from

This advisory is generated automatically by VEDAS from: CVE.org record, cve-scores (EPSS and VEDAS), Exploit Observer, vedas-signatures. Text in quotes is reproduced from the source; everything else is a fixed template filled with source fields. Nothing here is written by a language model. Check the vendor advisory before acting, and read how VEDAS and Exploit Observer work, and their limits.

Supporting partners

Feasible SecurityAskealGoTrust