CVE-2026-14756: SQL Injection in code-projects Hotel and Tourism Reservation

A critical SQL injection vulnerability, identified as CVE-2026-14756, has been discovered in version 1.0 of the code-projects Hotel and Tourism Reservation web application. This flaw resides within the Tour Management Page component, specifically affecting the /admin/add_tour.php file. The vulnerability stems from insufficient sanitization of user-supplied input, allowing attackers to manipulate the delete_image argument with malicious SQL queries. This remote vulnerability enables unauthenticated attackers to bypass security measures, gain unauthorized access to the database, extract sensitive information, or corrupt data. The exploit details for this vulnerability have been publicly disclosed, increasing the urgency for immediate remediation due to the heightened risk of exploitation in the wild. Defenders must prioritize patching and implementing robust detection mechanisms.

Attack Chain

1. Attacker identifies an exposed instance of code-projects Hotel and Tourism Reservation version 1.0.
2. Attacker crafts a specially designed HTTP POST request targeting the /admin/add_tour.php endpoint.
3. The crafted request includes an SQL injection payload embedded within the delete_image parameter.
4. The vulnerable application processes this request without properly sanitizing the delete_image input, directly incorporating the malicious payload into a backend SQL query.
5. The database executes the attacker's injected SQL query, allowing for unauthorized data access, modification, or deletion.
6. Attacker leverages the successful SQL injection to bypass authentication, exfiltrate sensitive data (e.g., user credentials, booking details), or manipulate existing database records.

Impact

Successful exploitation of CVE-2026-14756 can lead to severe consequences for organizations utilizing the vulnerable application. Attackers can gain full control over the application's database, leading to the compromise of customer personal identifiable information (PII), payment data, and sensitive business operational details. This can result in significant financial losses, reputational damage, regulatory penalties, and potential service disruption due to data manipulation or deletion. With the exploit publicly available, organizations face an immediate and high risk of data breaches and system integrity compromise if the vulnerability remains unpatched.

Recommendation

• Immediately patch or apply available updates for code-projects Hotel and Tourism Reservation 1.0 to address CVE-2026-14756.
• Deploy the Sigma rule provided in this brief to your SIEM for detection of CVE-2026-14756 exploitation attempts.
• Ensure Web Application Firewall (WAF) rules are configured to detect and block common SQL injection patterns, specifically targeting requests to /admin/add_tour.php with suspicious delete_image parameter values.
• Monitor web server access logs for /admin/add_tour.php for requests containing known SQL injection syntax or unusual characters.