CVE-2026-14754: Hotel Tourism Reservation SQLi Vulnerability

CVE-2026-14754 Overview

CVE-2026-14754 is a SQL injection vulnerability in code-projects Hotel and Tourism Reservation 1.0. The flaw resides in the /admin/add_room.php script, where multiple unsanitized parameters flow directly into backend SQL queries. Attackers can manipulate the delete_image, edit, description, number, price, rooms, or type arguments to inject arbitrary SQL statements. The attack requires no authentication and can be launched remotely over the network. A public exploit has been disclosed, increasing the likelihood of opportunistic scanning against exposed installations.

Critical Impact
Remote, unauthenticated attackers can inject SQL statements through the admin room management endpoint, exposing database contents and enabling data tampering in affected deployments.

Affected Products

code-projects Hotel and Tourism Reservation 1.0
Deployments exposing /admin/add_room.php to untrusted networks
Downstream forks and derivatives of the vulnerable PHP codebase

Discovery Timeline

2026-07-05 - CVE-2026-14754 published to NVD
2026-07-06 - Last updated in NVD database

Technical Details for CVE-2026-14754

Vulnerability Analysis

The vulnerability is classified under [CWE-74] as improper neutralization of special elements in output used by a downstream component (injection). The affected file, /admin/add_room.php, accepts several user-controlled parameters used to add, edit, or delete room records. These parameters are concatenated into SQL queries without parameterization or input sanitization.

An attacker can supply crafted values in any of the affected parameters (delete_image, edit, description, number, price, rooms, type) to alter query semantics. Successful exploitation can disclose database records, modify hotel and reservation data, or bypass administrative logic. Because the vector is network-based with no privileges or user interaction required, mass scanning is feasible.

Root Cause

The root cause is the direct inclusion of HTTP request parameters into SQL statements within add_room.php. The code path lacks prepared statements, parameter binding, or type coercion. Any string values submitted through the admin form or crafted HTTP requests are trusted as safe SQL fragments.

Attack Vector

Exploitation occurs remotely via HTTP requests to /admin/add_room.php. An attacker submits a manipulated value in one of the vulnerable parameters, embedding SQL syntax such as boolean-based, UNION-based, or time-based payloads. The published proof-of-concept demonstrates injection through the add_room.php interface. Technical exploitation details are documented in the Medium SQL Injection Analysis and the VulDB CVE-2026-14754 advisory.

// No verified exploit code is reproduced here.
// See the referenced advisories for technical proof-of-concept details.

Detection Methods for CVE-2026-14754

Indicators of Compromise

HTTP requests to /admin/add_room.php containing SQL metacharacters such as ', --, UNION, SLEEP(, or INFORMATION_SCHEMA
Anomalous request volume against the add_room.php endpoint from a single source IP
Web server or PHP error logs referencing SQL syntax errors triggered by the delete_image, edit, description, number, price, rooms, or type parameters
Unexpected changes in room, pricing, or reservation records without corresponding legitimate admin sessions

Detection Strategies

Deploy web application firewall (WAF) signatures targeting SQL injection patterns on the /admin/ path
Enable database query logging and alert on syntactically anomalous queries originating from the reservation application
Baseline legitimate admin activity and flag off-hours or unauthenticated access attempts to admin endpoints

Monitoring Recommendations

Forward web server access logs and database audit logs to a centralized SIEM for correlation
Monitor for outbound data transfers from the database host that could indicate exfiltration
Track authentication events on the admin interface and alert on brute-force or enumeration patterns preceding injection attempts

How to Mitigate CVE-2026-14754

Immediate Actions Required

Restrict network access to /admin/add_room.php to trusted management IP ranges using firewall or reverse proxy rules
Place the application behind a WAF with SQL injection detection enabled in blocking mode
Review database and application logs for signs of prior exploitation targeting the affected parameters
Rotate database credentials if compromise is suspected

Patch Information

No official vendor patch is referenced in the NVD entry at the time of publication. Administrators should monitor the Code Projects Resource Hub for updates. Until a fix is available, custom source code remediation is required: replace concatenated SQL strings in add_room.php with prepared statements using PDO or MySQLi parameter binding, and validate parameter types (numeric fields such as price, rooms, and number should be cast to integers or floats).

Workarounds

Disable or remove the add_room.php endpoint if the room management workflow is not actively used
Enforce authentication and role-based access control in front of all /admin/ routes via a reverse proxy
Apply virtual patching rules at the WAF layer to reject requests containing SQL metacharacters in the affected parameters
Isolate the database account used by the application with least-privilege permissions to limit blast radius

bash

# Example nginx location block restricting admin access by IP
location /admin/ {
    allow 10.0.0.0/24;
    deny all;
    proxy_pass http://backend;
}