CVE-2026-112152 in Criminal-Management-System
Summary
by MITRE • 10/19/2026
A security vulnerability has been detected in vraj404 Criminal-Management-System up to 2808d057e7ddc5295519a487365b0cacfd0ba8c4. Affected by this issue is the function mysqli_query of the file Officers/searchOff.php of the component Search Page. Such manipulation of the argument Search leads to sql injection. The attack may be performed from remote. The exploit has been disclosed publicly and may be used. This product utilizes a rolling release system for continuous delivery, and as such, version information for affected or updated releases is not disclosed. The project was informed of the problem early through an issue report but has not responded yet.
If you want to get the best quality for vulnerability data then you always have to consider VulDB.
Analysis
by VulDB Data Team • 10/19/2026
The vulnerability identified in the vraj404 Criminal-Management-System represents a critical SQL injection flaw located within the Search Page component, specifically affecting the mysqli_query function in the file Officers/searchOff.php. This weakness arises from improper validation and sanitization of user-supplied input passed through the Search argument. When an attacker constructs a malicious payload containing SQL metacharacters or logical operators, the application fails to distinguish between executable code and data input. Consequently, this allows the injection of arbitrary SQL commands into the backend database engine. The vulnerability is exploitable remotely, meaning that an unauthenticated or authenticated user with access to the search interface can leverage this flaw without requiring physical proximity to the target system.
From a technical perspective, this issue aligns directly with CWE-89: Improper Neutralization of Special Elements used in an SQL Command, commonly known as SQL Injection. The root cause lies in the concatenation or interpolation of unsanitized user input into SQL query strings before execution by the mysqli_query function. In many such implementations, developers may rely on weak filtering mechanisms that can be bypassed using encoding techniques, comment sequences, or tautologies. Because the system utilizes a rolling release model for continuous delivery, specific version numbers are not disclosed to track affected releases. This lack of fixed version identifiers complicates vulnerability management and patching efforts, as administrators cannot easily determine which deployments are susceptible based on standard version strings alone. The exploit code has been publicly disclosed, significantly lowering the barrier to entry for attackers who may possess limited technical expertise but have access to automated scanning tools or exploitation frameworks.
The operational impact of this SQL injection is severe and multifaceted. An attacker can potentially read sensitive data from the database, including personally identifiable information (PII) of officers, case details, evidence logs, and administrative credentials stored within the system. Beyond data exfiltration, depending on the privileges granted to the database user account used by the web application, an attacker might execute administrative operations such as modifying or deleting records, creating new users with elevated privileges, or even executing operating system commands if specific database features like xp_cmdshell are enabled and accessible. This compromises the confidentiality, integrity, and availability of the criminal management data, potentially leading to legal liabilities, reputational damage, and disruption of law enforcement operations. The fact that the project has been informed via an issue report but has not yet responded indicates a gap in security maintenance practices, leaving users exposed until a patch is developed or alternative mitigations are implemented.
To mitigate this vulnerability, immediate remediation steps should focus on input validation and parameterized queries. Developers must refactor the searchOff.php file to replace direct string concatenation with prepared statements using parameterized queries provided by the mysqli extension. This ensures that user input is treated strictly as data rather than executable code. Additionally, implementing strict server-side input validation that rejects unexpected characters or enforces whitelists for expected input formats can provide a defense-in-depth layer. For organizations currently running affected versions where an immediate patch is unavailable due to the rolling release model and lack of vendor response, network-level controls such as Web Application Firewalls (WAF) should be configured with rules specifically targeting SQL injection patterns in search parameters. Regular security audits and static application security testing (SAST) during development cycles are also recommended to prevent similar flaws from being introduced into future releases. The situation underscores the importance of proactive vulnerability management, especially for open-source projects where community support may vary in responsiveness.