CVE-2026-14755: Hotel Tourism Reservation SQLi Vulnerability

CVE-2026-14755 Overview

CVE-2026-14755 is a SQL injection vulnerability in code-projects Hotel and Tourism Reservation 1.0. The flaw resides in the /admin/reservations.php file within the Reservations Management Page component. Attackers can manipulate the delete argument to inject arbitrary SQL statements into backend database queries. The vulnerability is exploitable remotely over the network and requires no authentication or user interaction. Public disclosure of the exploit details has occurred, increasing the risk of opportunistic exploitation against exposed instances. The issue is classified under [CWE-74] (Improper Neutralization of Special Elements in Output Used by a Downstream Component).

Critical Impact
Remote, unauthenticated attackers can inject SQL through the delete parameter of /admin/reservations.php, potentially exposing or modifying reservation records.

Affected Products

code-projects Hotel and Tourism Reservation 1.0
/admin/reservations.php (Reservations Management Page component)
Deployments using the vulnerable delete parameter handling

Discovery Timeline

2026-07-05 - CVE-2026-14755 published to NVD
2026-07-06 - Last updated in NVD database

Technical Details for CVE-2026-14755

Vulnerability Analysis

The vulnerability exists in the reservations administration endpoint of code-projects Hotel and Tourism Reservation 1.0. The delete parameter passed to /admin/reservations.php is concatenated into a SQL query without proper sanitization or parameterization. An attacker supplies crafted input that breaks out of the intended query context and executes attacker-controlled SQL statements. Because the endpoint is reachable over the network and requires no privileges, exploitation only requires knowledge of the URL and parameter name. Impact affects confidentiality, integrity, and availability of the reservation database at a limited level per the assigned CVSS 4.0 metrics.

Root Cause

The root cause is improper neutralization of user-supplied input in a downstream SQL query [CWE-74]. The application concatenates the delete request parameter directly into a SQL statement instead of using prepared statements or parameterized queries. No input validation, type coercion, or allow-list filtering enforces that delete is a numeric identifier. This allows metacharacters and SQL keywords to alter query semantics.

Attack Vector

A remote attacker sends an HTTP request to /admin/reservations.php with a manipulated delete parameter value containing SQL syntax. The server passes the tainted value into a DELETE or SELECT statement, executing attacker-controlled logic against the reservations database. Techniques such as UNION-based extraction, boolean-based blind injection, or time-based blind injection can be used to enumerate schema, exfiltrate records, or tamper with reservation data. See the Anubhavv106 SQL Injection Advisory and VulDB CVE-2026-14755 entry for additional technical context.

Detection Methods for CVE-2026-14755

Indicators of Compromise

HTTP requests to /admin/reservations.php containing SQL metacharacters such as single quotes, UNION, SLEEP(, or -- in the delete parameter.
Unexpected DELETE or SELECT statements against reservation tables in database audit logs.
Web server access logs showing rapid, repeated requests to the reservations endpoint from a single source.
Application errors or 500 responses correlated with malformed delete parameter values.

Detection Strategies

Deploy a web application firewall rule that inspects query and body parameters to /admin/reservations.php for SQL injection payloads.
Enable database query logging and alert on syntactically anomalous statements referencing reservation tables.
Correlate authentication and admin access logs to identify unauthenticated requests reaching admin endpoints.

Monitoring Recommendations

Monitor outbound data volume from the database host for signs of bulk exfiltration.
Alert on new or unusual user-agent strings interacting with the admin path.
Track failed input validation events and 4xx/5xx spikes tied to the reservations endpoint.

How to Mitigate CVE-2026-14755

Immediate Actions Required

Restrict network access to the /admin/ path to trusted management networks or via VPN until a fix is applied.
Deploy WAF signatures blocking SQL injection patterns against the delete parameter of /admin/reservations.php.
Review database and web server logs for prior exploitation attempts using the disclosed exploit pattern.
Rotate database credentials if evidence of exploitation is identified.

Patch Information

No official vendor patch was referenced in the published CVE record at the time of writing. Track the VulDB Vulnerability #376344 entry and the Code Projects Security Resources site for vendor updates. Organizations running Hotel and Tourism Reservation 1.0 should apply source-level fixes by replacing string concatenation with parameterized queries and validating that delete is an integer.

Workarounds

Modify /admin/reservations.php to cast the delete parameter to an integer before use in any SQL statement.
Refactor affected queries to use prepared statements with bound parameters via mysqli or PDO.
Enforce administrator authentication and session checks on all /admin/ endpoints.
Disable or remove the reservations management endpoint if it is not required in production.

bash

# Example hardening: enforce integer-only delete parameter at the web tier
# nginx location block returning 400 for non-numeric delete values
location = /admin/reservations.php {
    if ($arg_delete !~ ^[0-9]+$) {
        return 400;
    }
    include fastcgi_params;
    fastcgi_pass unix:/run/php/php-fpm.sock;
}