CVE-2026-14688: SQL Injection in itsourcecode Hotel Management Admin Login

Executive Summary

CVE-2026-14688 is a high-severity SQL injection vulnerability in itsourcecode Online Hotel Management System version 1.0. The flaw exists in the admin login page (/admin/login.php), where the email parameter is passed unsanitized into a SQL query, allowing remote attackers to bypass authentication or extract database contents.

CVSS Score: 7.3 (High)

A publicly available exploit exists for this vulnerability. Hotel management systems often handle sensitive guest data, payment records, and reservation information, making this a significant risk for any deployment.

Technical Details

Vulnerability Type

SQL Injection (CWE-89) via unsanitized email parameter in the admin authentication flow. Rather than using parameterized queries, the application interpolates POST data directly into a SQL SELECT statement.

Attack Vector

Affected Endpoint

POST /admin/login.php
Parameter: email

Proof of Concept

An attacker can bypass the admin login entirely using a classic Boolean-based SQLi payload:

email: admin@hotel.com' OR '1'='1' -- -
password: (arbitrary)

Alternatively, UNION-based injection can enumerate the database:

email: ' UNION SELECT 1,username,password,4,5 FROM admin-- -

Time-based blind injection for stealth reconnaissance:

email: admin@hotel.com' AND SLEEP(5)-- -

Impact

Hotel management systems typically store highly sensitive data. Successful exploitation could expose:

• Guest personal information: names, contact details, passport/ID numbers
• Reservation and booking records: check-in/out dates, room assignments
• Admin credentials: hashed or plaintext passwords enabling full system takeover
• Payment-adjacent data: billing amounts, invoice records (though full card data is typically offloaded)
• Staff and employee records: if stored in the same database

An unauthenticated attacker gaining admin access could also:

• Modify or delete reservations
• Access all guest records
• Pivot to further exploitation of the server

Affected Versions

No patch is available from the vendor. The itsourcecode portfolio (similar to SourceCodester) consists of student/demo PHP scripts often deployed in small businesses and hospitality operators without security review.

Remediation

Immediate Actions

1. Restrict admin panel access — apply IP allowlisting at the web server level:

# .htaccess
<Files "login.php">
  Order deny,allow
  Deny from all
  Allow from 192.168.1.0/24
</Files>

2. Deploy a WAF — configure rules to block SQLi patterns targeting /admin/login.php

3. Rotate all admin credentials — assume existing passwords may be compromised if the system has been publicly accessible

Code-Level Fix

Replace the vulnerable authentication query with a parameterized equivalent:

// Vulnerable (DO NOT USE)
$email = $_POST['email'];
$query = "SELECT * FROM admin WHERE email='$email' AND password='$pass'";
$result = mysqli_query($conn, $query);
 
// Secure replacement
$stmt = $conn->prepare("SELECT * FROM admin WHERE email = ? AND password = ?");
$stmt->bind_param("ss", $_POST['email'], $hashed_password);
$stmt->execute();
$result = $stmt->get_result();

Additionally:

• Use password_hash() and password_verify() instead of plaintext or MD5 passwords
• Add rate limiting to the login endpoint to slow brute-force/injection attempts
• Enable display_errors = Off in php.ini for production deployments

Hospitality Sector Advisory

This vulnerability is a reminder that off-the-shelf PHP scripts from student/educational code repositories (SourceCodester, itsourcecode, etc.) are frequently deployed in production without security hardening. These codebases often predate modern PHP security practices and routinely omit:

• Prepared statements / parameterized queries
• Password hashing
• CSRF protection
• Session security hardening

Organizations in the hospitality sector should audit any PHP-based PMS (Property Management System) or booking system for similar patterns before deployment.

References

• NVD Entry — CVE-2026-14688
• OWASP SQL Injection Prevention Cheat Sheet
• OWASP Authentication Cheat Sheet
• CWE-89: Improper Neutralization of Special Elements used in an SQL Command