CVE-2026-14764: SQL Injection in Hotel and Tourism Reservation 1.0 Admin Interface

Technical summary

CVE-2026-14764 is a remote, unauthenticated SQL injection vulnerability affecting the /admin/add_event.php endpoint in code-projects Hotel and Tourism Reservation 1.0. The fdetails argument fails to properly sanitize or parameterize user input before incorporating it into SQL queries, enabling attackers to execute arbitrary database commands. The vulnerability maps to CWE-89 (SQL Injection) and CWE-74 (Improper Neutralization of Special Elements in Output), indicating both the injection vector and downstream output handling weaknesses. With a CVSS v3.1 score of 7.3 and network-accessible attack surface, this represents a practical security risk.

Business impact

An attacker exploiting this vulnerability could exfiltrate guest records, booking information, payment data, or administrative credentials from the reservation system. Depending on data sensitivity and regulatory obligations, this may trigger breach notification requirements and reputational damage. The ability to modify database contents could corrupt reservation records, disrupt operations, or enable privilege escalation for further system compromise. Organizations relying on this software for customer-facing services face service interruption and compliance violations.

Affected systems

The vulnerability affects code-projects Hotel and Tourism Reservation version 1.0. Any installation of this software that exposes the /admin/add_event.php interface to network access is at risk. Organizations should inventory all deployments of this product, particularly those accessible from the internet or from untrusted networks.

Exploitability

This vulnerability is exploitable with minimal barriers to entry. The attack requires no authentication, no user interaction, and can be launched remotely over the network. Public disclosure of this vulnerability has occurred, meaning attack tooling and proof-of-concept code may already be available or in development. The straightforward nature of SQL injection exploitation and lack of access controls on the affected endpoint make this a high-priority threat for active threat actors.

Remediation

Immediate action is required. First, verify if your organization uses Hotel and Tourism Reservation 1.0 and identify all network-exposed instances. Contact the vendor (code-projects) for patched versions or mitigation guidance. If updates are unavailable, implement network segmentation to restrict access to /admin/add_event.php to trusted administrative networks only, and deploy Web Application Firewall (WAF) rules to detect and block SQL injection patterns targeting the fdetails parameter. Apply input validation and parameterized query updates as interim controls.

Patch guidance

Contact code-projects directly to obtain patched release information, as specific version numbers are not yet disclosed in public advisories. Prioritize deployment of any available patches to version 1.0 installations immediately upon release. Until patching is complete, apply compensating controls such as WAF rules, network access restrictions, and database activity monitoring. Verify patches with the vendor advisory before deployment to production.

Detection guidance

Monitor HTTP POST requests to /admin/add_event.php for SQL injection signatures, including escape sequences, SQL keywords (SELECT, UNION, DROP, INSERT, UPDATE), and encoded payloads in the fdetails parameter. Enable database query logging and alert on unexpected or failed SQL queries from the application user. Review access logs for repeated requests to the event management endpoint from unexpected sources. Intrusion detection systems should flag SQL injection patterns in web traffic destined for this endpoint.

Why prioritize this

This vulnerability merits immediate prioritization due to the combination of high CVSS score (7.3), remote unauthenticated access, public disclosure, and direct impact on sensitive customer data. SQL injection vulnerabilities in administrative interfaces are frequently targeted by automated scanners and exploit tools. The lack of authentication barriers and network accessibility create urgent exploitation risk. Organizations running this software should treat patching or mitigation as critical.

Risk score, explained

The CVSS v3.1 score of 7.3 (HIGH) reflects a network-accessible, authentication-free attack surface (AV:N/AC:L/PR:N) with low complexity, combined with confidentiality, integrity, and availability impact. While not scored as CRITICAL, the combination of public disclosure, ease of exploitation, and data sensitivity in hospitality reservation systems elevates real-world risk significantly above the base score for many organizations.

Frequently asked questions