Hotel and Tourism Reservation 1.0 - CraftedSignal Threat Feed

CVE-2026-14764: SQL Injection in code-projects Hotel and Tourism Reservation

hello@craftedsignal.io — Sun, 05 Jul 2026 17:23:25 +0000

A critical SQL injection vulnerability, tracked as CVE-2026-14764, has been identified in code-projects Hotel and Tourism Reservation version 1.0. This flaw, discovered in the 'Event Management Page' component, specifically affects the /admin/add_event.php file where the fdetails argument is susceptible to improper neutralization of special elements. Attackers can remotely manipulate this argument to inject malicious SQL queries, leading to data compromise. The vulnerability has been publicly disclosed, with exploit details available, significantly increasing the likelihood of active exploitation against unpatched systems running this software. Organizations utilizing code-projects Hotel and Tourism Reservation 1.0 are strongly advised to implement mitigations immediately to prevent unauthorized access and data breaches.

Attack Chain

An unauthenticated attacker identifies an internet-facing instance of code-projects Hotel and Tourism Reservation 1.0.
The attacker crafts a malicious HTTP POST or GET request targeting the /admin/add_event.php endpoint.
The attacker injects SQL payloads into the fdetails argument, which is processed by the vulnerable application.
The application processes the request without properly sanitizing the input, leading to the execution of the attacker's SQL queries.
The malicious SQL query allows the attacker to read, modify, or delete database content, potentially extracting sensitive information or altering application behavior.
The attacker successfully compromises the underlying database, gaining unauthorized access to user credentials, booking details, or other critical data.

Impact

Successful exploitation of CVE-2026-14764 can lead to significant data compromise, including the exfiltration of sensitive customer information, booking data, and administrative credentials stored in the application's database. This can result in reputational damage, regulatory penalties, and further attacks against affected entities. Given that exploit details have been publicly disclosed, unpatched systems face an immediate and elevated risk of being targeted by malicious actors seeking to leverage this vulnerability for financial gain or disruptive purposes.

Recommendation

Prioritize patching or upgrading code-projects Hotel and Tourism Reservation to a version that addresses CVE-2026-14764, once available from the vendor.
Deploy the Sigma rule provided in this brief to your SIEM to detect exploitation attempts of CVE-2026-14764 against your web servers.
Implement a Web Application Firewall (WAF) in front of the vulnerable application to detect and block malicious HTTP requests containing SQL injection payloads, specifically targeting cs-uri-stem: "/admin/add_event.php" and the fdetails parameter.
Enable detailed webserver access logging (e.g., Apache, Nginx, IIS) to capture cs-uri-stem, cs-uri-query, and HTTP method, essential for forensic analysis and detection.

CVE-2026-14763: SQL Injection in code-projects Hotel and Tourism Reservation

hello@craftedsignal.io — Sun, 05 Jul 2026 17:22:25 +0000

A critical SQL injection vulnerability, identified as CVE-2026-14763, exists in version 1.0 of the code-projects Hotel and Tourism Reservation software. This flaw specifically impacts the "Tour Reservations Page" component, residing within the /admin/tour_reserves.php file. Attackers can remotely exploit this vulnerability by manipulating the tour argument in HTTP GET requests, which is then improperly handled, leading to the execution of arbitrary SQL commands. The vulnerability has been assigned a CVSS v3.1 base score of 7.3 (High). A public exploit has been published and may be used, indicating a heightened risk of active exploitation against unpatched systems. Organizations utilizing this reservation system are strongly advised to take immediate action to mitigate the risk of data compromise and unauthorized access.

Attack Chain

An attacker identifies a publicly accessible instance of code-projects Hotel and Tourism Reservation 1.0.
The attacker crafts a malicious HTTP GET request targeting the vulnerable endpoint /admin/tour_reserves.php.
This request includes specially crafted SQL injection payloads embedded within the tour argument (e.g., ' OR 1=1--, UNION SELECT).
The Hotel and Tourism Reservation web application receives the request and processes the tour argument without adequate input sanitization.
The malicious input is directly concatenated into a backend SQL query, causing the database to execute the attacker's arbitrary SQL commands.
Successful SQL injection allows the attacker to retrieve sensitive information (e.g., user credentials, booking details) from the database, modify existing data, or potentially gain further access to the underlying server depending on database privileges.
The attacker exfiltrates the compromised data or leverages the access for further malicious activities, such as website defacement or pivot to other systems.

Impact

Successful exploitation of CVE-2026-14763 can lead to severe consequences for organizations using the code-projects Hotel and Tourism Reservation 1.0 software. Attackers can gain unauthorized access to the application's backend database, potentially leading to the exfiltration of sensitive customer data (e.g., personal information, contact details, booking histories), administrative credentials, and other proprietary business information. This data compromise can result in significant financial losses, reputational damage, regulatory penalties, and a loss of customer trust. Given the "public exploit available" status, organizations running affected versions face an imminent threat of being targeted and breached if not promptly patched.

Recommendation

Immediately patch or update code-projects Hotel and Tourism Reservation 1.0 to a non-vulnerable version if available. Monitor the https://code-projects.org/ website for official patches.
Deploy the Sigma rule Detect CVE-2026-14763 Exploitation - SQL Injection in Tour Reservations Page provided in this brief to your SIEM for early detection of exploitation attempts.
Monitor web server logs for HTTP requests targeting /admin/tour_reserves.php with unusual or suspicious characters in the tour query parameter, as indicated in the Sigma rule.
Implement a Web Application Firewall (WAF) in front of the Hotel and Tourism Reservation application to filter and block malicious SQL injection payloads targeting CVE-2026-14763.
Regularly review and sanitize user input across all web applications to prevent similar SQL injection vulnerabilities.

CVE-2026-14762: Remote SQL Injection in code-projects Hotel and Tourism Reservation

hello@craftedsignal.io — Sun, 05 Jul 2026 16:20:55 +0000

A significant vulnerability, identified as CVE-2026-14762, has been discovered in code-projects Hotel and Tourism Reservation version 1.0. This flaw specifically impacts an unspecified function within the /admin/rooms.php file, part of the application's Room Management Page. Attackers can exploit this vulnerability by manipulating the delete argument with SQL injection payloads. This issue is remotely exploitable, meaning an attacker does not require local access to the affected system. The exploit code for CVE-2026-14762 is publicly available, increasing the urgency for immediate mitigation by organizations utilizing this software. Successful exploitation can lead to unauthorized access, modification, or deletion of database contents, potentially compromising sensitive customer or reservation data.

Attack Chain

Attacker identifies a vulnerable instance of code-projects Hotel and Tourism Reservation 1.0 exposed to the internet.
Attacker crafts a malicious HTTP GET request targeting the /admin/rooms.php endpoint.
The request includes a specially crafted SQL injection payload within the delete argument, bypassing input sanitization (e.g., GET /admin/rooms.php?delete=' OR 1=1--).
The vulnerable PHP application processes the request and concatenates the malicious delete argument value directly into an SQL query.
The backend database executes the attacker-controlled SQL query, treating the payload as legitimate SQL code.
Depending on the payload, the database may return sensitive information, allow data modification/deletion, or enable further database compromise.
The application returns the result of the arbitrary SQL query to the attacker via the HTTP response.
Attacker achieves unauthorized access to, or modification of, the application's underlying database, potentially leading to full data compromise.

Impact

Successful exploitation of CVE-2026-14762 grants attackers unauthorized access to the application's database. This can lead to the exfiltration of sensitive information, such as customer details, reservation data, or administrator credentials. Attackers could also modify or delete critical operational data, causing service disruption or data integrity issues. Given that the exploit is public, organizations using Hotel and Tourism Reservation 1.0 are at immediate and severe risk of data breaches and operational downtime. The CVSS v3.1 score of 7.3 (HIGH) reflects the potential for significant impact on confidentiality, integrity, and availability.

Recommendation

Patch CVE-2026-14762 by updating code-projects Hotel and Tourism Reservation 1.0 to a secure version as soon as a fix is available from the vendor.
Deploy the Sigma rules in this brief to your SIEM and tune for your environment to detect exploitation attempts.
Implement a Web Application Firewall (WAF) to inspect and block malicious HTTP requests containing SQL injection payloads targeting /admin/rooms.php.
Regularly review web server access logs for suspicious requests to /admin/rooms.php that include uncommon characters or SQL keywords in the query parameters.

CVE-2026-14756: SQL Injection in code-projects Hotel and Tourism Reservation

hello@craftedsignal.io — Sun, 05 Jul 2026 15:20:14 +0000

A critical SQL injection vulnerability, identified as CVE-2026-14756, has been discovered in version 1.0 of the code-projects Hotel and Tourism Reservation web application. This flaw resides within the Tour Management Page component, specifically affecting the /admin/add_tour.php file. The vulnerability stems from insufficient sanitization of user-supplied input, allowing attackers to manipulate the delete_image argument with malicious SQL queries. This remote vulnerability enables unauthenticated attackers to bypass security measures, gain unauthorized access to the database, extract sensitive information, or corrupt data. The exploit details for this vulnerability have been publicly disclosed, increasing the urgency for immediate remediation due to the heightened risk of exploitation in the wild. Defenders must prioritize patching and implementing robust detection mechanisms.

Attack Chain

Attacker identifies an exposed instance of code-projects Hotel and Tourism Reservation version 1.0.
Attacker crafts a specially designed HTTP POST request targeting the /admin/add_tour.php endpoint.
The crafted request includes an SQL injection payload embedded within the delete_image parameter.
The vulnerable application processes this request without properly sanitizing the delete_image input, directly incorporating the malicious payload into a backend SQL query.
The database executes the attacker's injected SQL query, allowing for unauthorized data access, modification, or deletion.
Attacker leverages the successful SQL injection to bypass authentication, exfiltrate sensitive data (e.g., user credentials, booking details), or manipulate existing database records.

Impact

Successful exploitation of CVE-2026-14756 can lead to severe consequences for organizations utilizing the vulnerable application. Attackers can gain full control over the application's database, leading to the compromise of customer personal identifiable information (PII), payment data, and sensitive business operational details. This can result in significant financial losses, reputational damage, regulatory penalties, and potential service disruption due to data manipulation or deletion. With the exploit publicly available, organizations face an immediate and high risk of data breaches and system integrity compromise if the vulnerability remains unpatched.

Recommendation

Immediately patch or apply available updates for code-projects Hotel and Tourism Reservation 1.0 to address CVE-2026-14756.
Deploy the Sigma rule provided in this brief to your SIEM for detection of CVE-2026-14756 exploitation attempts.
Ensure Web Application Firewall (WAF) rules are configured to detect and block common SQL injection patterns, specifically targeting requests to /admin/add_tour.php with suspicious delete_image parameter values.
Monitor web server access logs for /admin/add_tour.php for requests containing known SQL injection syntax or unusual characters.

CVE-2026-14755: Remote SQL Injection in code-projects Hotel and Tourism Reservation

hello@craftedsignal.io — Sun, 05 Jul 2026 15:19:25 +0000

A high-severity remote SQL injection vulnerability, identified as CVE-2026-14755, has been discovered in version 1.0 of the code-projects Hotel and Tourism Reservation application. This flaw resides in the /admin/reservations.php file, within the Reservations Management Page component. Attackers can remotely exploit this by manipulating the delete argument in HTTP requests, leading to arbitrary SQL query execution on the backend database. This vulnerability allows for unauthorized access to, modification of, or deletion of sensitive reservation data. The exploit details have been publicly disclosed, increasing the risk of widespread exploitation. Organizations using this specific version of the software are urged to take immediate action to mitigate the risk of data compromise, service disruption, and potential full system compromise.

Attack Chain

An unauthenticated attacker identifies an exposed instance of code-projects Hotel and Tourism Reservation 1.0.
The attacker crafts a malicious HTTP GET request targeting the /admin/reservations.php endpoint.
The request includes a specifically crafted delete argument containing SQL injection payloads (e.g., delete=' UNION SELECT ... --').
The vulnerable application processes this delete argument without proper input sanitization, leading to the attacker's SQL payload being appended to and executed by the backend database query.
The application's response reveals information about the database structure or sensitive data extracted via the SQL injection.
The attacker leverages the successful injection to exfiltrate confidential customer and reservation data, manipulate existing records, or potentially gain further access to the underlying system depending on database privileges.

Impact

Successful exploitation of CVE-2026-14755 can lead to severe consequences for organizations utilizing the vulnerable software. Attackers can gain full control over the application's database, allowing them to exfiltrate sensitive customer information (names, contact details, payment information if stored), manipulate or delete reservation records, and potentially disrupt business operations. Given the public disclosure of the exploit, any internet-facing instance of Hotel and Tourism Reservation 1.0 is at high risk. This can result in significant financial losses, reputational damage, regulatory fines, and loss of customer trust.

Recommendation

Immediately patch or upgrade code-projects Hotel and Tourism Reservation to a version that addresses CVE-2026-14755, if available. If no patch exists, remove the application from production until a secure version is released.
Deploy the provided Sigma rule to detect attempts to exploit CVE-2026-14755 via the /admin/reservations.php endpoint in your web server logs.
Implement a Web Application Firewall (WAF) to inspect and block malicious HTTP requests, specifically those targeting /admin/reservations.php with SQL injection payloads in the delete parameter.
Review web server access logs for anomalous requests to the /admin/reservations.php path, especially those containing common SQL injection keywords or unusual characters in query parameters.

CVE-2026-14754: SQL Injection in code-projects Hotel and Tourism Reservation

hello@craftedsignal.io — Sun, 05 Jul 2026 14:22:49 +0000

CVE-2026-14754 details a high-severity SQL injection vulnerability affecting code-projects Hotel and Tourism Reservation version 1.0. This flaw, discovered in an unspecified function within the /admin/add_room.php file, allows remote, unauthenticated attackers to inject malicious SQL queries by manipulating specific arguments like delete_image, edit, description, number, price, rooms, or type. The exploit for this vulnerability has been publicly disclosed and is actively available, increasing the immediate risk to organizations using the affected software. Given its remote exploitability and the availability of public exploits, this vulnerability poses a significant threat to the confidentiality and integrity of data stored within the application's database. Defenders should prioritize patching or implementing strong input validation to prevent exploitation.

Attack Chain

Initial Access: An unauthenticated attacker sends an HTTP POST or GET request to the /admin/add_room.php endpoint of the vulnerable Hotel and Tourism Reservation 1.0 web application.
Parameter Manipulation: The attacker crafts the request to include malicious SQL syntax within one of the vulnerable arguments (e.g., delete_image, edit, description, number, price, rooms, or type).
SQL Injection: The web application processes the request, and due to insufficient input sanitization, the embedded malicious SQL payload is passed directly to the backend database for execution.
Database Interaction: The database server executes the attacker-controlled SQL query, which can be designed to retrieve, modify, or delete sensitive information.
Information Disclosure: The results of the malicious SQL query, such as sensitive user credentials, payment information, or other confidential data, are returned within the HTTP response to the attacker.
Data Exfiltration: The attacker extracts the disclosed sensitive data, compromising the confidentiality of the application's database content.
Impact: The successful SQL injection allows unauthorized access to the application's database, leading to potential data theft, manipulation, or denial of service, depending on the attacker's objectives and database privileges.

Impact

Successful exploitation of CVE-2026-14754 directly compromises the confidentiality and integrity of the data stored within the application's database. Attackers can exfiltrate sensitive customer and reservation data, modify booking details, or potentially manipulate administrator credentials for further access. While a specific number of victims is not available, any organization utilizing code-projects Hotel and Tourism Reservation 1.0 is at risk, particularly those with internet-facing deployments. The remote nature of the attack means that compromise can occur without physical access or prior authentication, making the impact widespread for affected instances.

Recommendation

Patch: Immediately apply any available patches or updates for code-projects Hotel and Tourism Reservation 1.0 as they become available to address CVE-2026-14754.
Implement Input Validation: Deploy the Sigma rule CVE-2026-14754: Detect SQL Injection Attempts in Hotel Reservation System to your web application firewall (WAF) or SIEM to detect and potentially block requests containing SQL injection payloads targeting /admin/add_room.php.
Monitor Web Server Logs: Ensure comprehensive logging is enabled for your web server (e.g., IIS, Apache, Nginx) to capture detailed HTTP request information, including full URI-stem and query parameters, which are crucial for activating the detection rule above.
Review Database Privileges: Restrict the privileges of the database user account used by the web application to the absolute minimum necessary to function, thereby limiting the potential damage from a successful SQL injection.