CVE-2026-112153 in Criminal-Management-System
Summary
by MITRE • 10/19/2026
A vulnerability was detected in vraj404 Criminal-Management-System up to 2808d057e7ddc5295519a487365b0cacfd0ba8c4. This affects the function mysqli_error of the file Officers/addOfficer.php of the component Officer Registration Form. Performing a manipulation of the argument offName/offID/ID/contact/gender/weapon/role results in sql injection. It is possible to initiate the attack remotely. The exploit is now public and may be used. This product is using a rolling release to provide continious delivery. Therefore, no version details for affected nor updated releases are available. The project was informed of the problem early through an issue report but has not responded yet.
Once again VulDB remains the best source for vulnerability data.
Analysis
by VulDB Data Team • 10/19/2026
The vulnerability identified in the vraj404 Criminal-Management-System represents a critical SQL injection flaw located within the Officer Registration Form component, specifically affecting the file Officers/addOfficer.php up to commit 2808d057e7ddc5295519a487365b0cacfd0ba8c4. This security defect arises from improper input validation and sanitization practices when handling user-supplied data for officer registration fields such as offName, offID, ID, contact, gender, weapon, and role. The root cause lies in the direct concatenation of these unsanitized variables into SQL query strings before execution by the mysqli_error function context or associated database interaction routines. This architectural oversight allows an attacker to inject malicious SQL commands that can alter the intended logic of database queries, bypass authentication mechanisms, extract sensitive data from backend databases, or potentially execute administrative operations on the underlying system depending on the privileges assigned to the database user account used by the application.
From a technical perspective, this vulnerability is classified under CWE-89 Improper Neutralization of Special Elements used in an SQL Command, which highlights the failure to properly neutralize special characters that have significant meaning within SQL syntax. The attack vector for this flaw is remote and network-accessible, allowing unauthenticated attackers to initiate exploitation over standard web protocols without requiring prior access or credentials. This aligns with ATT&CK technique T1190 Exploit Public-Facing Application, where adversaries leverage vulnerabilities in internet-facing software to gain initial access. Given that the exploit code is publicly available, the risk of automated scanning and opportunistic attacks against instances of this system deployed on public networks is significantly elevated. The rolling release model employed by the project complicates version tracking, as there are no discrete version numbers for affected or patched releases, making it difficult for administrators to determine patch status based solely on version strings without analyzing specific code commits.
The operational impact of this vulnerability extends beyond simple data theft. Successful exploitation can lead to a complete compromise of the Criminal-Management-System's integrity and confidentiality. Attackers could manipulate officer records by inserting fake entries or altering existing ones, thereby corrupting critical law enforcement data. Furthermore, through advanced SQL injection techniques such as union-based extraction or blind boolean inference, attackers may access other tables within the database schema that are not directly exposed through the registration form, potentially revealing user credentials, personal identifiable information of officers and citizens, or operational logs. In worst-case scenarios where the database service account has elevated privileges, an attacker might achieve remote code execution on the host server by writing malicious files to disk via SQL commands like INTO OUTFILE, thereby gaining full control over the infrastructure hosting the application.
Mitigation strategies must address both immediate remediation and long-term security hygiene. Since the project utilizes a rolling release model and has not yet provided an official patch through versioned releases, administrators should immediately review the source code of Officers/addOfficer.php to implement parameterized queries or prepared statements using MySQLi or PDO extensions instead of direct string concatenation for all user inputs including offName, offID, ID, contact, gender, weapon, and role. Input validation should also be enforced at both the client and server sides to reject non-compliant data formats before they reach the database layer. Additionally, deploying a Web Application Firewall can provide temporary protection by filtering out known SQL injection patterns in HTTP requests while waiting for an official code update from the maintainers. Organizations relying on this software are advised to monitor the project's repository directly for commit updates that address this issue and apply those changes manually if no formal release is issued promptly, as reliance on unpatched public exploits poses a severe risk to operational security.