| Title | vraj404 Criminal-Management-System 2808d057e7ddc5295519a487365b0cacfd0ba8c4 SQL Injection |
|---|
| Description | The affected component is `search.php` (site root), the unauthenticated "Search Records" page. The search term is concatenated directly into a SQL query without escaping or prepared statements, and no authentication is enforced:
```php
$data=$_POST['search'];
$_SESSION['data']=$data;
$q1="SELECT * FROM info WHERE name='$data'";
$result=mysqli_query($conn,$q1);
```
The raw payload is additionally persisted into `$_SESSION['data']` and re-executed by `printable.php` through the identical query, so the same injection can be triggered from two entry points. Because the page is reachable without login, any remote attacker can inject `UNION SELECT` payloads to extract the full database (verified: `users.uname`/`users.pass` retrieved) and tamper with queries over criminal records containing personal data (names, DOB, addresses).
|
|---|
| Source | ⚠️ https://github.com/vraj404/Criminal-Management-System/issues/2 |
|---|
| User | SoyaBean (UID 101904) |
|---|
| Submission | 10/05/2026 17:24 (22 days ago) |
|---|
| Moderation | 10/19/2026 07:50 (14 days later) |
|---|
| Status | Accepted |
|---|
| VulDB entry | 422257 [vraj404 Criminal-Management-System up to 2808d057e7ddc5295519a487365b0cacfd0ba8c4 search.php search sql injection] |
|---|
| Points | 20 |
|---|