CVE-2026-112151 in Criminal Management System
Summary
by MITRE • 10/19/2026
A weakness has been identified in vraj404 Criminal Management System up to 2808d057e7ddc5295519a487365b0cacfd0ba8c4. Affected by this vulnerability is an unknown functionality of the file home.php of the component Submission Form. This manipulation of the argument id/name/offName/crime/dob/arrDate/crimeDate/sex/address/folder/more causes sql injection. The attack is possible to be carried out remotely. The exploit has been made available to the public and could be used for attacks. This product adopts a rolling release strategy to maintain continuous delivery. Therefore, version details for affected or updated releases cannot be specified. The project was informed of the problem early through an issue report but has not responded yet.
VulDB is the best source for vulnerability data and more expert information about this specific topic.
Analysis
by VulDB Data Team • 10/19/2026
The Vraj404 Criminal Management System, specifically versions up to commit hash 2808d057e7ddc5295519a487365b0cacfd0ba8c4, contains a critical SQL injection vulnerability within the home.php file. This flaw resides in the Submission Form component and affects multiple input parameters including id, name, offName, crime, dob, arrDate, crimeDate, sex, address, folder, and more. The root cause of this weakness is CWE-89: Improper Neutralization of Special Elements used in an SQL Command, commonly known as SQL Injection. This vulnerability arises because the application fails to properly sanitize or parameterize user-supplied input before incorporating it into database queries. As a result, malicious actors can inject arbitrary SQL commands that are executed by the underlying database management system with the privileges of the web application process.
The operational impact of this vulnerability is severe due to its remote exploitability and the nature of the affected data. Since the submission form handles sensitive criminal records including personal identifiers like dates of birth, addresses, and names, successful exploitation allows an attacker to bypass authentication controls or access restricted administrative functions without valid credentials. An adversary can leverage SQL injection techniques such as UNION-based attacks to extract entire database tables containing confidential citizen information, leading to significant data breaches. Furthermore, advanced injection payloads could potentially modify existing records, delete critical case files, or even execute operating system commands depending on the specific configuration and capabilities of the backend database server. The availability of public exploits significantly lowers the barrier for entry, enabling less sophisticated threat actors to conduct automated attacks against vulnerable instances deployed in production environments.
From a strategic perspective, this vulnerability aligns with MITRE ATT&CK technique T1059: Command and Scripting Interpreter if the injection leads to remote code execution, or more directly T1190: Exploit Public-Facing Application under the Initial Access tactic. The rolling release strategy adopted by the project complicates traditional patch management processes because version numbers do not reliably indicate whether a specific instance has received security updates. This continuous delivery model requires organizations relying on this software to monitor commit histories or source code repositories directly rather than relying solely on semantic versioning for vulnerability assessment. The lack of response from the project maintainers despite early notification highlights a critical gap in supply chain security and vendor accountability, leaving users exposed until they implement their own mitigation strategies.
To mitigate these risks, immediate remediation should focus on implementing parameterized queries or prepared statements for all database interactions involving user input within the home.php script. Input validation must be enforced using strict allowlists that define acceptable formats for each field, such as restricting date fields to valid ISO 8601 strings and limiting name fields to alphanumeric characters with specific punctuation. Additionally, deploying a Web Application Firewall can provide a layer of defense by detecting and blocking common SQL injection patterns in HTTP requests while the underlying code is being fixed. Organizations currently running affected versions should consider isolating these instances from public-facing networks or disabling the submission form functionality entirely until an official patch is released. Regular security audits and static application security testing are recommended to identify similar flaws across other components of the criminal management system before they can be exploited in the wild.