Description
A vulnerability was detected in code-projects Hotel and Tourism Reservation 1.0. The impacted element is an unknown function of the file /admin/rooms.php of the component Room Management Page. The manipulation of the argument delete results in sql injection. It is possible to launch the attack remotely. The exploit is now public and may be used.
Published: 2026-07-05
Score: 6.9 Medium
EPSS: < 1% Very Low
KEV: No
Impact: n/a
Action: n/a
AI Analysis

Impact

An SQL injection flaw (CWE‑74: Unfiltered Input and CWE‑89: Improper Restriction of SQL Command Parameters) in the rooms.php script. Attackers can inject arbitrary SQL statements, potentially altering, extracting, or deleting booking records and related data. The compromise threatens data confidentiality and integrity, and could also disrupt the service if critical tables are modified or removed.

Affected Systems

The vulnerability affects code‑projects’ Hotel and Tourism Reservation 1.0, specifically the Room Management Page located at /admin/rooms.php; administrators should confirm that they are using this or an older release.

Risk and Exploitability

The CVSS score of 6.9 indicates a moderate risk, and the EPSS score of less than 1 % shows that exploitation is unlikely but still possible. Because it is not listed in CISA’s KEV catalog, no widespread exploitation has been documented yet. Attackers could execute the flaw remotely by sending a crafted delete parameter; the exact exploitation steps are inferred from the description.

Generated by OpenCVE AI on July 23, 2026 at 15:43 UTC.

Remediation

No vendor fix or workaround currently provided.

OpenCVE Recommended Actions

  • Apply any to a newer release where the delete functionality is properly sanitized.
  • Refactor the delete handling in rooms.php to use prepared statements with bound parameters, eliminating direct string concatenation.
  • Validate and whitelist the delete argument to accept only expected values, rejecting any other input.
  • Limit administrator access to rooms.php via IP whitelisting or two‑factor authentication to reduce the exposure window.

Generated by OpenCVE AI on July 23, 2026 at 15:43 UTC.

Tracking

Sign in to view the affected projects.

Advisories

No advisories yet.

History

Tue, 07 Jul 2026 03:30:00 +0000

Type Values Removed Values Added
Metrics ssvc

{'options': {'Automatable': 'yes', 'Exploitation': 'poc', 'Technical Impact': 'partial'}, 'version': '2.0.3'}

Sun, 05 Jul 2026 16:15:00 +0000

Type Values Removed Values Added
Description A vulnerability was detected in code-projects Hotel and Tourism Reservation 1.0. The impacted element is an unknown function of the file /admin/rooms.php of the component Room Management Page. The manipulation of the argument delete results in sql injection. It is possible to launch the attack remotely. The exploit is now public and may be used.
Title code-projects Hotel and Tourism Reservation Room Management rooms.php sql injection
First Time appeared Code-projects
Code-projects hotel And Tourism Reservation
Weaknesses CWE-74
CWE-89
CPEs cpe:2.3:a:code-projects:hotel_and_tourism_reservation:*:*:*:*:*:*:*:*
Vendors & Products Code-projects
Code-projects hotel And Tourism Reservation
References
Metrics cvssV2_0

{'score': 7.5, 'vector': 'AV:N/AC:L/Au:N/C:P/I:P/A:P/E:POC/RL:ND/RC:UR'}

cvssV3_0

{'score': 7.3, 'vector': 'CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:L/E:P/RL:X/RC:R'}

cvssV3_1

{'score': 7.3, 'vector': 'CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:L/E:P/RL:X/RC:R'}

cvssV4_0

{'score': 6.9, 'vector': 'CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:L/VI:L/VA:L/SC:N/SI:N/SA:N/E:P'}

Subscriptions

Code-projects Hotel And Tourism Reservation
cve-icon MITRE

Status: PUBLISHED

Assigner: VulDB

Published:

Updated: 2026-07-07T02:52:16.860Z

Reserved: 2026-07-04T16:28:12.308Z

Link: CVE-2026-14762

cve-icon Vulnrichment

Updated: 2026-07-07T02:52:13.171Z

cve-icon NVD

No data.

cve-icon Redhat

No data.

cve-icon OpenCVE Enrichment

Updated: 2026-07-23T15:45:02Z

Weaknesses
  • CWE-74

    Improper Neutralization of Special Elements in Output Used by a Downstream Component ('Injection')

  • CWE-89

    Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection')