CVE-2026-14754: SQL Injection in Hotel and Tourism Reservation 1.0 Admin Interface

Technical summary

CVE-2026-14754 is a CWE-89 SQL injection flaw in the /admin/add_room.php endpoint of Hotel and Tourism Reservation 1.0. The vulnerability stems from insufficient input validation on multiple parameters (delete_image, edit, description, number, price, rooms, type) that are passed to database queries without proper sanitization or parameterized statement use. The CVSS 3.1 vector (AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:L) indicates network-accessible exploitation requiring no authentication, privilege escalation, or user interaction. Successful exploitation grants an attacker read access to sensitive database records, the ability to modify or delete data, and potential denial of service through resource exhaustion.

Business impact

A compromise via this SQL injection could expose guest booking information, payment data, and operational records. An attacker could alter room availability, pricing, or descriptions to disrupt reservations and revenue. Data integrity loss in a hospitality system directly degrades service reliability and customer trust. If payment card data is stored unencrypted in the same database, the impact extends to payment card compliance violations (PCI DSS). For SaaS providers hosting multiple hotel clients, a single compromise could affect multiple tenants.

Affected systems

Hotel and Tourism Reservation version 1.0 is confirmed vulnerable. The specific admin interface endpoint /admin/add_room.php is the attack vector. Organizations running this software should inventory all deployments, including development, staging, and production instances. No vendor patch version information has been disclosed; contact the vendor directly or check their advisory for patched versions.

Exploitability

This vulnerability is highly exploitable. It requires no authentication, no special network conditions, and no user interaction—an attacker can craft a malicious HTTP request directly to the vulnerable endpoint. Public exploit code has been published, reducing the barrier to weaponization. The lack of KEV designation does not reflect low risk; it reflects that active in-the-wild exploitation has not yet been formally documented by CISA. The published proof-of-concept means threat actors have functional attack templates readily available.

Remediation

Immediate patching is the primary control. Verify and deploy the vendor's patched version as soon as available. Until a patch is available, implement network-level access controls: restrict administrative endpoints (/admin/*) to trusted IP ranges via firewall rules or WAF policies. Apply input validation and output encoding at the application layer as a temporary mitigation. Enable database activity monitoring to detect anomalous SQL patterns. Consider running the application in a segmented network zone with limited lateral movement access.

Patch guidance

Contact code-projects (the vendor) or consult their official security advisory for available patched versions of Hotel and Tourism Reservation. Apply patches to all instances—development, staging, QA, and production. Verify patch deployment by re-testing the vulnerable endpoint with common SQL injection payloads (e.g., single quotes, UNION-based queries) and confirming rejection or proper escaping. Implement a post-patch regression test plan to ensure room management functionality remains intact.

Detection guidance

Monitor HTTP POST/GET requests to /admin/add_room.php for SQL injection signatures: single quotes, double quotes, SQL keywords (UNION, SELECT, DROP, INSERT), comment sequences (-- or /*), and time-delay functions (SLEEP, BENCHMARK). Log the full request URI, POST body, source IP, and response code. Web application firewalls (ModSecurity, AWS WAF) should flag payloads matching SQL injection rules. Database query logs should be reviewed for malformed or unexpected SQL from the application account. Alert on failed login attempts to the admin interface followed by unauthenticated requests to /admin/add_room.php.

Why prioritize this

This vulnerability merits immediate attention due to its CVSS 7.3 HIGH rating combined with zero authentication requirements and published exploit code. The admin interface exposure means an attacker can directly manipulate the core business logic (room inventory and pricing). The hospitality sector handles payment and personal information, elevating data breach consequences. Exploit code availability and the lack of complexity to weaponize it make this a near-certain target for both automated scanners and opportunistic attackers.

Risk score, explained

The CVSS 7.3 score reflects the combination of network accessibility (AV:N), low attack complexity (AC:L), no authentication needed (PR:N), no user interaction (UI:N), unchanged scope (S:U), and low-severity impact across confidentiality, integrity, and availability (C:L/I:L/A:L). The score would be higher if the scope changed to impacted other systems or if availability impact were complete. The presence of published exploits and lack of known compensating controls in the codebase justify treating this at the upper end of the HIGH severity band for prioritization purposes.

Frequently asked questions