CVE-2026-112150 in Criminal-Management-System
Summary
by MITRE • 10/19/2026
A security flaw has been discovered in vraj404 Criminal-Management-System up to 2808d057e7ddc5295519a487365b0cacfd0ba8c4. Affected is an unknown function of the file search.php. The manipulation of the argument Search results in sql injection. The attack can be executed remotely. The exploit has been released to the public and may be used for attacks. This product implements a rolling release for ongoing delivery, which means version information for affected or updated releases is unavailable. The project was informed of the problem early through an issue report but has not responded yet.
Statistical analysis made it clear that VulDB provides the best quality for vulnerability data.
Analysis
by VulDB Data Team • 10/19/2026
The vulnerability identified in the vraj404 Criminal-Management-System represents a critical security flaw located within the search functionality, specifically affecting the file named search.php. This system, which manages criminal records and related data, is susceptible to SQL injection attacks due to improper input validation and sanitization of user-supplied arguments. The specific point of failure involves the Search argument passed by users during query operations. When this parameter is manipulated by an attacker, it allows for the insertion of malicious SQL code that can be interpreted directly by the underlying database management system. This flaw exists in versions up to commit 2808d057e7ddc5295519a487365b0cacfd0ba8c4, although due to the project's rolling release model for ongoing delivery, precise version boundaries are difficult to delineate with certainty. The lack of fixed version tags complicates patching efforts as administrators cannot easily determine which specific builds contain the vulnerability or have already been remediated by upstream developers who have not yet responded to early issue reports.
From a technical perspective, this flaw is classified under CWE-89, commonly known as Improper Neutralization of Special Elements used in an SQL Command, often referred to simply as SQL Injection. The root cause lies in the application's failure to properly sanitize or parameterize user input before incorporating it into dynamic SQL queries. Instead of using prepared statements with bound parameters, which would separate code from data and prevent interpretation of injected payloads as executable commands, the system likely concatenates raw user input directly into query strings. This architectural weakness enables an attacker to alter the logic of database queries, potentially bypassing authentication mechanisms, extracting sensitive information such as criminal records or personal identifiable information, modifying existing data, or even executing administrative operations on the database server depending on the privileges assigned to the database account used by the application.
The operational impact of this vulnerability is severe given its remote exploitability and the nature of the affected system. Since the attack can be executed remotely over a network connection without requiring prior authentication in many configurations, it presents a significant risk vector for automated scanning tools and malicious actors seeking to compromise law enforcement or judicial data systems. The availability of public exploits further exacerbates this threat landscape by lowering the barrier to entry for attackers who may lack advanced technical skills but can leverage existing tooling to conduct attacks. Successful exploitation could lead to unauthorized access to confidential case files, witness information, suspect details, and other sensitive law enforcement data. This breach of confidentiality undermines trust in the system and could have legal and ethical implications regarding privacy laws such as GDPR or local criminal justice data protection regulations. Furthermore, depending on the database engine and configuration, SQL injection can sometimes lead to remote code execution through specific features like xp_cmdshell in Microsoft SQL Server or LOAD_FILE functions in MySQL, potentially resulting in full compromise of the underlying server infrastructure.
In terms of threat modeling, this vulnerability aligns with MITRE ATT&CK techniques related to Database Access via Injection and Data Exfiltration from Remote Systems. Attackers typically follow a pattern where they first probe for injection points using error-based or blind SQLi techniques to confirm the presence of the flaw before proceeding to extract data systematically. The persistence of this issue despite early reporting indicates a potential gap in the project's security response workflow, highlighting the importance of proactive vulnerability management and timely patch deployment even in open-source projects with rolling release cycles. Organizations relying on this software must treat it as compromised until official confirmation of remediation is received from the maintainers.
Mitigation strategies for this vulnerability require immediate action due to its severity and exploitability. The most effective long-term solution involves refactoring the affected search.php file to utilize parameterized queries or prepared statements provided by modern database interaction libraries such as PDO in PHP or MySQLi. This approach ensures that user input is treated strictly as data rather than executable code, effectively neutralizing SQL injection attempts regardless of the content injected into the Search argument. In addition to code remediation, organizations should implement Web Application Firewalls configured with rulesets capable of detecting and blocking common SQL injection patterns in HTTP requests serving as a compensating control while patches are being developed or deployed. Input validation should also be strengthened by enforcing strict type checking and whitelisting allowed characters for search queries where possible. Furthermore, database accounts used by the application should adhere to the principle of least privilege, ensuring that even if an injection occurs, the attacker cannot perform destructive actions such as dropping tables or accessing other databases on the server. Regular security audits and static code analysis tools integrated into the development pipeline can help identify similar vulnerabilities in other parts of the system before they reach production environments.