| Title | vraj404 Criminal-Management-System 2808d057e7ddc5295519a487365b0cacfd0ba8c4 SQL Injection |
|---|
| Description | The affected component is `Officers/searchOff.php`, the officer search page of the Officers directory. The search term is concatenated raw into a `SELECT` statement (a second identically built `DELETE` statement on the same input is also prepared in the same block), and the page performs no authentication:
```php
$data=$_POST['search'];
$q1="SELECT offName, offID,ID,contact,gender,weapon,role FROM officer WHERE offName='$data'";
$q2="DELETE FROM `officer` WHERE officer.offName='$data'";
$result=mysqli_query($conn,$q1);
```
Any remote attacker can bypass the name filter (`' OR '1'='1`) to dump all officer records, or use `UNION SELECT` payloads to read arbitrary tables (verified: `users.uname`/`users.pass` extracted without any login).
|
|---|
| Source | ⚠️ https://github.com/vraj404/Criminal-Management-System/issues/4 |
|---|
| User | Quanqie (UID 101906) |
|---|
| Submission | 10/05/2026 17:27 (23 days ago) |
|---|
| Moderation | 10/19/2026 07:51 (14 days later) |
|---|
| Status | Accepted |
|---|
| VulDB entry | 422259 [vraj404 Criminal-Management-System up to 2808d057e7ddc5295519a487365b0cacfd0ba8c4 Search Page Officers/searchOff.php mysqli_query search sql injection] |
|---|
| Points | 20 |
|---|