CVE-2026-14756 Overview
CVE-2026-14756 is a SQL injection vulnerability in code-projects Hotel and Tourism Reservation 1.0. The flaw resides in the /admin/add_tour.php script within the Tour Management Page component. Attackers manipulate the delete_image parameter to inject arbitrary SQL statements into backend database queries. The vulnerability requires no authentication and can be exploited remotely over the network. Public exploit details have been released, increasing the likelihood of opportunistic attacks against exposed installations. The issue is classified under [CWE-74] (Improper Neutralization of Special Elements in Output).
Critical Impact
Unauthenticated attackers can inject SQL statements through the delete_image parameter to read, modify, or delete database contents in the tour management workflow.
Affected Products
- code-projects Hotel and Tourism Reservation 1.0
- Component: Tour Management Page (/admin/add_tour.php)
- Vulnerable parameter: delete_image
Discovery Timeline
- 2026-07-05 - CVE-2026-14756 published to NVD
- 2026-07-07 - Last updated in NVD database
Technical Details for CVE-2026-14756
Vulnerability Analysis
The vulnerability is a SQL injection flaw in the add_tour.php administrative script. The application accepts the delete_image argument from the HTTP request and concatenates its value directly into a SQL statement without parameterization or sanitization. An attacker can supply malicious SQL fragments through this parameter to alter query logic. Because the attack targets an administrative endpoint that lacks effective authentication enforcement in this build, remote unauthenticated exploitation is possible. Impact extends across confidentiality, integrity, and availability of the database, with limited scope per the CVSS v4.0 vector.
Root Cause
The root cause is improper neutralization of user-controlled input passed to a database query. The delete_image parameter is not validated, escaped, or bound as a prepared statement parameter. This defect maps to [CWE-74], covering injection weaknesses where untrusted data reaches an interpreter without proper handling.
Attack Vector
Exploitation occurs over the network by sending a crafted HTTP request to /admin/add_tour.php containing a malicious delete_image payload. No user interaction and no privileges are required. Attackers can use standard SQL injection techniques such as boolean-based, union-based, or time-based blind injection to extract data or manipulate records. Public disclosure of exploitation details in the referenced GitHub Security Advisory lowers the barrier for opportunistic use.
No verified proof-of-concept code is reproduced here. See the VulDB CVE-2026-14756 entry and the associated GitHub advisory for technical exploitation details.
Detection Methods for CVE-2026-14756
Indicators of Compromise
- HTTP requests to /admin/add_tour.php containing SQL metacharacters such as single quotes, UNION, SLEEP(, or comment sequences in the delete_image parameter.
- Web server access logs showing anomalous or repeated POST/GET requests from a single source targeting the tour management endpoint.
- Database error messages referencing syntax errors originating from the add_tour.php script.
Detection Strategies
- Deploy web application firewall rules that flag SQL injection patterns targeting the delete_image parameter.
- Enable database query logging and alert on unexpected queries originating from the add_tour.php execution context.
- Correlate authentication events with administrative endpoint access to identify unauthenticated hits to /admin/ paths.
Monitoring Recommendations
- Monitor outbound database traffic for unusual query volume or data extraction patterns from the reservation application host.
- Alert on error rates and 500-series responses tied to add_tour.php that indicate probe attempts.
- Track file access on the web server for reads or writes to sensitive files that could indicate secondary exploitation.
How to Mitigate CVE-2026-14756
Immediate Actions Required
- Restrict network access to the /admin/ directory using IP allow lists or VPN-only access until a patch is available.
- Deploy a web application firewall with SQL injection signatures in front of the application.
- Review database accounts used by the application and enforce least-privilege permissions to limit blast radius.
- Audit web and database logs for prior exploitation attempts against add_tour.php.
Patch Information
No official vendor patch has been published at the time of writing. The affected software is distributed by code-projects and referenced through the Code Projects Repository. Administrators should track the VulDB Vulnerability #376345 entry for updates. Where source code is available, developers should convert affected queries to parameterized statements and add server-side input validation for the delete_image parameter.
Workarounds
- Remove or disable the /admin/add_tour.php endpoint if the tour management feature is not required.
- Add server-side input validation that rejects non-numeric or non-expected values for the delete_image parameter before it reaches SQL logic.
- Apply WAF rules that block requests containing SQL keywords in the delete_image field.
- Isolate the application in a segmented network zone with strict egress controls to limit data exfiltration if exploited.
# Example ModSecurity rule to block SQLi patterns in delete_image parameter
SecRule ARGS:delete_image "@rx (?i)(union(.*?)select|sleep\(|benchmark\(|--|;|/\*|xp_)" \
"id:1014756,phase:2,deny,status:403,log,msg:'Potential SQLi against add_tour.php (CVE-2026-14756)'"
Disclaimer: This content was generated using AI. While we strive for accuracy, please verify critical information with official sources.
