Description
A vulnerability was found in code-projects Hotel and Tourism Reservation 1.0. Affected by this issue is some unknown functionality of the file /admin/add_tour.php of the component Tour Management Page. The manipulation of the argument delete_image results in sql injection. The attack may be launched remotely. The exploit has been made public and could be used.
Published: 2026-07-05
Score: 6.9 Medium
EPSS: < 1% Very Low
KEV: No
Impact: n/a
Action: n/a
AI Analysis

Impact

A flaw exists in the /admin/add_tour.php page of code-projects Hotel and Tourism Reservation 1.0. Manipulating the delete_image parameter allows an attacker to inject arbitrary SQL code directly into a query without proper sanitization, enabling the attacker to read, modify, or delete data stored in the backend database and thereby compromising confidentiality, integrity, and availability.

Affected Systems

The only affected product is code-projects Hotel and Tourism Reservation version 1.0. The vulnerability can be triggered by any user who can reach the /admin/add_tour.php endpoint, potentially including unprivileged users if authentication is not enforced.

Risk and Exploitability

The CVSS score of 6.9 places the vulnerability in the medium severity range. The EPSS score of less than 1% and the absence from the CISA KEV catalog suggest that widespread exploitation is currently unlikely, yet the public exploit files confirm that an attacker can reach the injection point remotely via the delete_image parameter. The description does not state whether authentication is required, so an unprivileged user may also be able to trigger the vulnerability if the endpoint is exposed.

Generated by OpenCVE AI on July 24, 2026 at 09:39 UTC.

Remediation

No vendor fix or workaround currently provided.

OpenCVE Recommended Actions

  • Apply the vendor’s published security fix or upgrade to a newer release that sanitizes the delete_image input.
  • Restrict access to the /admin/add_tour.php endpoint by enforcing authentication and IP whitelisting.
  • Use a vulnerability scanner to locate any other unsanitized inputs in the application and remediate them.

Generated by OpenCVE AI on July 24, 2026 at 09:39 UTC.

Tracking

Sign in to view the affected projects.

Advisories

No advisories yet.

History

Tue, 07 Jul 2026 03:30:00 +0000

Type Values Removed Values Added
Metrics ssvc

{'options': {'Automatable': 'yes', 'Exploitation': 'poc', 'Technical Impact': 'partial'}, 'version': '2.0.3'}

Sun, 05 Jul 2026 14:45:00 +0000

Type Values Removed Values Added
Description A vulnerability was found in code-projects Hotel and Tourism Reservation 1.0. Affected by this issue is some unknown functionality of the file /admin/add_tour.php of the component Tour Management Page. The manipulation of the argument delete_image results in sql injection. The attack may be launched remotely. The exploit has been made public and could be used.
Title code-projects Hotel and Tourism Reservation Tour Management add_tour.php sql injection
First Time appeared Code-projects
Code-projects hotel And Tourism Reservation
Weaknesses CWE-74
CWE-89
CPEs cpe:2.3:a:code-projects:hotel_and_tourism_reservation:*:*:*:*:*:*:*:*
Vendors & Products Code-projects
Code-projects hotel And Tourism Reservation
References
Metrics cvssV2_0

{'score': 7.5, 'vector': 'AV:N/AC:L/Au:N/C:P/I:P/A:P/E:POC/RL:ND/RC:UR'}

cvssV3_0

{'score': 7.3, 'vector': 'CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:L/E:P/RL:X/RC:R'}

cvssV3_1

{'score': 7.3, 'vector': 'CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:L/E:P/RL:X/RC:R'}

cvssV4_0

{'score': 6.9, 'vector': 'CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:L/VI:L/VA:L/SC:N/SI:N/SA:N/E:P'}

Subscriptions

Code-projects Hotel And Tourism Reservation
cve-icon MITRE

Status: PUBLISHED

Assigner: VulDB

Published:

Updated: 2026-07-07T02:51:19.151Z

Reserved: 2026-07-04T15:56:18.347Z

Link: CVE-2026-14756

cve-icon Vulnrichment

Updated: 2026-07-07T02:51:15.478Z

cve-icon NVD

No data.

cve-icon Redhat

No data.

cve-icon OpenCVE Enrichment

Updated: 2026-07-24T09:45:02Z

Weaknesses
  • CWE-74

    Improper Neutralization of Special Elements in Output Used by a Downstream Component ('Injection')

  • CWE-89

    Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection')