CVE-2026-14764: Hotel and Tourism Reservation SQLi Flaw

CVE-2026-14764 Overview

CVE-2026-14764 is a SQL injection vulnerability in code-projects Hotel and Tourism Reservation 1.0. The flaw resides in the /admin/add_event.php file, part of the Event Management Page component. Attackers can manipulate the fdetails argument to inject arbitrary SQL statements into backend database queries. The vulnerability is exploitable remotely over the network without authentication or user interaction. A public exploit has been disclosed, increasing the likelihood of opportunistic attacks against unpatched deployments. The issue is tracked under CWE-74 (Improper Neutralization of Special Elements in Output Used by a Downstream Component).

Critical Impact
Remote unauthenticated attackers can inject SQL statements through the fdetails parameter in /admin/add_event.php, enabling database manipulation and data disclosure.

Affected Products

code-projects Hotel and Tourism Reservation 1.0
Component: Event Management Page (/admin/add_event.php)
Vulnerable parameter: fdetails

Discovery Timeline

2026-07-05 - CVE-2026-14764 published to NVD
2026-07-06 - Last updated in NVD database

Technical Details for CVE-2026-14764

Vulnerability Analysis

The vulnerability is a classic SQL injection flaw located in the administrative event management workflow of the Hotel and Tourism Reservation application. When a request reaches /admin/add_event.php, the fdetails argument is concatenated into a SQL statement without proper sanitization or parameterization. An attacker supplying crafted input can break out of the intended query context and append arbitrary SQL clauses. The advisory published on GitHub confirms the injection point and provides reproduction steps. Because the exploit is public and the attack vector is network-based, defenders should treat this as an opportunistic exposure. The EPSS probability of 0.269% suggests moderate likelihood of exploitation attempts in the near term.

Root Cause

The root cause is failure to neutralize user-supplied input before including it in a SQL query. The fdetails parameter is passed directly from the HTTP request into the database driver without prepared statements, parameter binding, or input validation. This maps to CWE-74, where downstream interpreters process attacker-controlled content as executable code.

Attack Vector

Exploitation requires sending a crafted HTTP request to the /admin/add_event.php endpoint with a malicious payload in the fdetails field. Depending on deployment, the administrative page may be reachable without authentication, allowing a remote attacker to execute injected SQL against the underlying MySQL database. Successful exploitation can lead to reading, modifying, or deleting records, and in some configurations, extracting credentials or pivoting further into the environment. See the VulDB entry for CVE-2026-14764 for additional technical context.

Detection Methods for CVE-2026-14764

Indicators of Compromise

HTTP POST or GET requests to /admin/add_event.php containing SQL metacharacters such as ', --, UNION, or SLEEP( in the fdetails parameter.
Web server access logs showing unusually long or encoded fdetails values from unfamiliar source IP addresses.
Database error messages returned to clients referencing MySQL syntax issues originating from the event management workflow.

Detection Strategies

Deploy web application firewall (WAF) signatures that flag SQL injection patterns targeting the fdetails parameter.
Enable database query logging and alert on anomalous statements executed by the application user, such as UNION SELECT or INFORMATION_SCHEMA lookups.
Correlate spikes in 500-series HTTP responses from /admin/add_event.php with source IP reputation feeds.

Monitoring Recommendations

Continuously monitor administrative endpoints for unauthenticated access attempts and record full request bodies.
Track outbound network connections from the database server to identify data exfiltration following suspected injection.
Baseline normal event submission traffic and alert on volume or payload deviations.

How to Mitigate CVE-2026-14764

Immediate Actions Required

Restrict network access to /admin/ paths using IP allowlists, VPN, or authenticated reverse proxies until a fix is validated.
Audit the add_event.php source and replace string concatenation with parameterized queries or prepared statements.
Review database logs for evidence of prior exploitation, focusing on unusual queries originating from the event management workflow.

Patch Information

No vendor patch has been published for code-projects Hotel and Tourism Reservation 1.0 at the time of CVE assignment. Administrators should monitor the code-projects site for updates and apply application-level fixes to sanitize the fdetails parameter. Refer to the GitHub SQL Injection Advisory for reproduction details that inform remediation testing.

Workarounds

Implement WAF rules that reject requests to /admin/add_event.php containing SQL metacharacters in the fdetails field.
Enforce least-privilege on the database account used by the application to limit the impact of successful injection.
Disable or remove the Event Management Page if the feature is not required in production.

bash

# Example ModSecurity rule to block SQL metacharacters in fdetails
SecRule ARGS:fdetails "@rx (?i)(union(\s|\+)+select|sleep\(|--|;|/\*)" \
    "id:1026147640,phase:2,deny,status:403,\
    msg:'CVE-2026-14764 SQLi attempt in fdetails'"