https://feed.craftedsignal.io/tags/code-projects/Trending threats, MITRE ATT&CK coverage, and detection metadata. Fed continuously.Hugoenhello@craftedsignal.iohello@craftedsignal.ioSun, 05 Jul 2026 15:20:14 +0000https://feed.craftedsignal.io/briefs/2026-07-cve-2026-14756-sql-injection/Sun, 05 Jul 2026 15:20:14 +0000hello@craftedsignal.iohttps://feed.craftedsignal.io/briefs/2026-07-cve-2026-14756-sql-injection/A remote SQL injection vulnerability (CVE-2026-14756) exists in code-projects Hotel and Tourism Reservation version 1.0, allowing unauthenticated attackers to exploit improper input sanitization in the `delete_image` parameter of `/admin/add_tour.php` to bypass authentication, extract sensitive data, or manipulate database records, with a public exploit available.A critical SQL injection vulnerability, identified as CVE-2026-14756, has been discovered in version 1.0 of the code-projects Hotel and Tourism Reservation web application. This flaw resides within the Tour Management Page component, specifically affecting the /admin/add_tour.php file. The vulnerability stems from insufficient sanitization of user-supplied input, allowing attackers to manipulate the delete_image argument with malicious SQL queries. This remote vulnerability enables unauthenticated attackers to bypass security measures, gain unauthorized access to the database, extract sensitive information, or corrupt data. The exploit details for this vulnerability have been publicly disclosed, increasing the urgency for immediate remediation due to the heightened risk of exploitation in the wild. Defenders must prioritize patching and implementing robust detection mechanisms.

Attack Chain

1. Attacker identifies an exposed instance of code-projects Hotel and Tourism Reservation version 1.0.
2. Attacker crafts a specially designed HTTP POST request targeting the /admin/add_tour.php endpoint.
3. The crafted request includes an SQL injection payload embedded within the delete_image parameter.
4. The vulnerable application processes this request without properly sanitizing the delete_image input, directly incorporating the malicious payload into a backend SQL query.
5. The database executes the attacker's injected SQL query, allowing for unauthorized data access, modification, or deletion.
6. Attacker leverages the successful SQL injection to bypass authentication, exfiltrate sensitive data (e.g., user credentials, booking details), or manipulate existing database records.

Impact

Successful exploitation of CVE-2026-14756 can lead to severe consequences for organizations utilizing the vulnerable application. Attackers can gain full control over the application's database, leading to the compromise of customer personal identifiable information (PII), payment data, and sensitive business operational details. This can result in significant financial losses, reputational damage, regulatory penalties, and potential service disruption due to data manipulation or deletion. With the exploit publicly available, organizations face an immediate and high risk of data breaches and system integrity compromise if the vulnerability remains unpatched.

Recommendation

• Immediately patch or apply available updates for code-projects Hotel and Tourism Reservation 1.0 to address CVE-2026-14756.
• Deploy the Sigma rule provided in this brief to your SIEM for detection of CVE-2026-14756 exploitation attempts.
• Ensure Web Application Firewall (WAF) rules are configured to detect and block common SQL injection patterns, specifically targeting requests to /admin/add_tour.php with suspicious delete_image parameter values.
• Monitor web server access logs for /admin/add_tour.php for requests containing known SQL injection syntax or unusual characters.

]]>highthreatsql-injectionweb-applicationcvecode-projectshttps://feed.craftedsignal.io/briefs/2026-07-cve-2026-14754-hotel-reservation-sqli/Sun, 05 Jul 2026 14:22:49 +0000hello@craftedsignal.iohttps://feed.craftedsignal.io/briefs/2026-07-cve-2026-14754-hotel-reservation-sqli/A critical SQL injection vulnerability (CVE-2026-14754) in code-projects Hotel and Tourism Reservation 1.0's `/admin/add_room.php` file allows a remote, unauthenticated attacker to manipulate arguments such as `delete_image`, `edit`, `description`, `number`, `price`, `rooms`, or `type` to execute arbitrary SQL commands, leading to sensitive data exposure and potential database compromise.CVE-2026-14754 details a high-severity SQL injection vulnerability affecting code-projects Hotel and Tourism Reservation version 1.0. This flaw, discovered in an unspecified function within the /admin/add_room.php file, allows remote, unauthenticated attackers to inject malicious SQL queries by manipulating specific arguments like delete_image, edit, description, number, price, rooms, or type. The exploit for this vulnerability has been publicly disclosed and is actively available, increasing the immediate risk to organizations using the affected software. Given its remote exploitability and the availability of public exploits, this vulnerability poses a significant threat to the confidentiality and integrity of data stored within the application's database. Defenders should prioritize patching or implementing strong input validation to prevent exploitation.

Attack Chain

1. Initial Access: An unauthenticated attacker sends an HTTP POST or GET request to the /admin/add_room.php endpoint of the vulnerable Hotel and Tourism Reservation 1.0 web application.
2. Parameter Manipulation: The attacker crafts the request to include malicious SQL syntax within one of the vulnerable arguments (e.g., delete_image, edit, description, number, price, rooms, or type).
3. SQL Injection: The web application processes the request, and due to insufficient input sanitization, the embedded malicious SQL payload is passed directly to the backend database for execution.
4. Database Interaction: The database server executes the attacker-controlled SQL query, which can be designed to retrieve, modify, or delete sensitive information.
5. Information Disclosure: The results of the malicious SQL query, such as sensitive user credentials, payment information, or other confidential data, are returned within the HTTP response to the attacker.
6. Data Exfiltration: The attacker extracts the disclosed sensitive data, compromising the confidentiality of the application's database content.
7. Impact: The successful SQL injection allows unauthorized access to the application's database, leading to potential data theft, manipulation, or denial of service, depending on the attacker's objectives and database privileges.

Impact

Successful exploitation of CVE-2026-14754 directly compromises the confidentiality and integrity of the data stored within the application's database. Attackers can exfiltrate sensitive customer and reservation data, modify booking details, or potentially manipulate administrator credentials for further access. While a specific number of victims is not available, any organization utilizing code-projects Hotel and Tourism Reservation 1.0 is at risk, particularly those with internet-facing deployments. The remote nature of the attack means that compromise can occur without physical access or prior authentication, making the impact widespread for affected instances.

Recommendation

• Patch: Immediately apply any available patches or updates for code-projects Hotel and Tourism Reservation 1.0 as they become available to address CVE-2026-14754.
• Implement Input Validation: Deploy the Sigma rule CVE-2026-14754: Detect SQL Injection Attempts in Hotel Reservation System to your web application firewall (WAF) or SIEM to detect and potentially block requests containing SQL injection payloads targeting /admin/add_room.php.
• Monitor Web Server Logs: Ensure comprehensive logging is enabled for your web server (e.g., IIS, Apache, Nginx) to capture detailed HTTP request information, including full URI-stem and query parameters, which are crucial for activating the detection rule above.
• Review Database Privileges: Restrict the privileges of the database user account used by the web application to the absolute minimum necessary to function, thereby limiting the potential damage from a successful SQL injection.

]]>highadvisorysql-injectionweb-applicationcvecode-projectsremote-code-execution