Description
A flaw has been found in code-projects Hotel and Tourism Reservation 1.0. Affected is an unknown function of the file /admin/add_room.php. Executing a manipulation of the argument delete_image/edit/description/number/price/rooms/type can lead to sql injection. The attack can be launched remotely. The exploit has been published and may be used.
Published: 2026-07-05
Score: 6.9 Medium
EPSS: < 1% Very Low
KEV: No
Impact: n/a
Action: n/a
AI Analysis

Impact

An undisclosed routine within the /admin/add_room.php script of code-projects Hotel and Tourism Reservation version, number, price, rooms, and type parameters via crafted requests. This manipulation results in SQL injection, as identified by CWE-74 and CWE-89, permitting attackers to execute arbitrary SQL statements against the backend database. The potential impact includes unauthorized data disclosure, data manipulation such as altering room pricing, and deletion of stored images.

Affected Systems

The vulnerability is present only in the code-projects Hotel and Tourism Reservation 1.0 application; no other releases or vendors have been reported to contain the flaw. The affected endpoint is /admin/add_room.php.

Risk and Exploitability

The CVSS score of 6.9 indicates moderate severity, while the EPSS score of <1% reflects a low but non‑zero exploitation probability. The flaw is not listed in the CISA KEV catalog. Exploitation requires remote access to the /admin/add_room.php endpoint, and published exploit code confirms the vulnerability is actionable.

Generated by OpenCVE AI on July 26, 2026 at 21:18 UTC.

Remediation

No vendor fix or workaround currently provided.

OpenCVE Recommended Actions

  • Apply any vendor‑issued patch for Hotel and Tourism Reservation 1.0 as soon as it becomes available.
  • Restrict access to /admin/add_room.php to authenticated administrators and enforce multi‑factor authentication.
  • Sanitize all user‑supplied parameters or use parameterized SQL queries to prevent injection.

Generated by OpenCVE AI on July 26, 2026 at 21:18 UTC.

Tracking

Sign in to view the affected projects.

Advisories

No advisories yet.

History

Mon, 06 Jul 2026 18:30:00 +0000

Type Values Removed Values Added
Metrics ssvc

{'options': {'Automatable': 'yes', 'Exploitation': 'poc', 'Technical Impact': 'partial'}, 'version': '2.0.3'}

Sun, 05 Jul 2026 14:15:00 +0000

Type Values Removed Values Added
Description A flaw has been found in code-projects Hotel and Tourism Reservation 1.0. Affected is an unknown function of the file /admin/add_room.php. Executing a manipulation of the argument delete_image/edit/description/number/price/rooms/type can lead to sql injection. The attack can be launched remotely. The exploit has been published and may be used.
Title code-projects Hotel and Tourism Reservation add_room.php sql injection
First Time appeared Code-projects
Code-projects hotel And Tourism Reservation
Weaknesses CWE-74
CWE-89
CPEs cpe:2.3:a:code-projects:hotel_and_tourism_reservation:*:*:*:*:*:*:*:*
Vendors & Products Code-projects
Code-projects hotel And Tourism Reservation
References
Metrics cvssV2_0

{'score': 7.5, 'vector': 'AV:N/AC:L/Au:N/C:P/I:P/A:P/E:POC/RL:ND/RC:UR'}

cvssV3_0

{'score': 7.3, 'vector': 'CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:L/E:P/RL:X/RC:R'}

cvssV3_1

{'score': 7.3, 'vector': 'CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:L/E:P/RL:X/RC:R'}

cvssV4_0

{'score': 6.9, 'vector': 'CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:L/VI:L/VA:L/SC:N/SI:N/SA:N/E:P'}

Subscriptions

Code-projects Hotel And Tourism Reservation
cve-icon MITRE

Status: PUBLISHED

Assigner: VulDB

Published:

Updated: 2026-07-06T17:43:45.755Z

Reserved: 2026-07-04T15:56:13.427Z

Link: CVE-2026-14754

cve-icon Vulnrichment

Updated: 2026-07-06T17:41:33.619Z

cve-icon NVD

No data.

cve-icon Redhat

No data.

cve-icon OpenCVE Enrichment

Updated: 2026-07-26T21:30:04Z

Weaknesses
  • CWE-74

    Improper Neutralization of Special Elements in Output Used by a Downstream Component ('Injection')

  • CWE-89

    Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection')