CVE-2026-14763: SQL Injection in code-projects Hotel and Tourism Reservation

A critical SQL injection vulnerability, identified as CVE-2026-14763, exists in version 1.0 of the code-projects Hotel and Tourism Reservation software. This flaw specifically impacts the "Tour Reservations Page" component, residing within the /admin/tour_reserves.php file. Attackers can remotely exploit this vulnerability by manipulating the tour argument in HTTP GET requests, which is then improperly handled, leading to the execution of arbitrary SQL commands. The vulnerability has been assigned a CVSS v3.1 base score of 7.3 (High). A public exploit has been published and may be used, indicating a heightened risk of active exploitation against unpatched systems. Organizations utilizing this reservation system are strongly advised to take immediate action to mitigate the risk of data compromise and unauthorized access.

Attack Chain

1. An attacker identifies a publicly accessible instance of code-projects Hotel and Tourism Reservation 1.0.
2. The attacker crafts a malicious HTTP GET request targeting the vulnerable endpoint /admin/tour_reserves.php.
3. This request includes specially crafted SQL injection payloads embedded within the tour argument (e.g., ' OR 1=1--, UNION SELECT).
4. The Hotel and Tourism Reservation web application receives the request and processes the tour argument without adequate input sanitization.
5. The malicious input is directly concatenated into a backend SQL query, causing the database to execute the attacker's arbitrary SQL commands.
6. Successful SQL injection allows the attacker to retrieve sensitive information (e.g., user credentials, booking details) from the database, modify existing data, or potentially gain further access to the underlying server depending on database privileges.
7. The attacker exfiltrates the compromised data or leverages the access for further malicious activities, such as website defacement or pivot to other systems.

Impact

Successful exploitation of CVE-2026-14763 can lead to severe consequences for organizations using the code-projects Hotel and Tourism Reservation 1.0 software. Attackers can gain unauthorized access to the application's backend database, potentially leading to the exfiltration of sensitive customer data (e.g., personal information, contact details, booking histories), administrative credentials, and other proprietary business information. This data compromise can result in significant financial losses, reputational damage, regulatory penalties, and a loss of customer trust. Given the "public exploit available" status, organizations running affected versions face an imminent threat of being targeted and breached if not promptly patched.

Recommendation

• Immediately patch or update code-projects Hotel and Tourism Reservation 1.0 to a non-vulnerable version if available. Monitor the https://code-projects.org/ website for official patches.
• Deploy the Sigma rule Detect CVE-2026-14763 Exploitation - SQL Injection in Tour Reservations Page provided in this brief to your SIEM for early detection of exploitation attempts.
• Monitor web server logs for HTTP requests targeting /admin/tour_reserves.php with unusual or suspicious characters in the tour query parameter, as indicated in the Sigma rule.
• Implement a Web Application Firewall (WAF) in front of the Hotel and Tourism Reservation application to filter and block malicious SQL injection payloads targeting CVE-2026-14763.
• Regularly review and sanitize user input across all web applications to prevent similar SQL injection vulnerabilities.