| Title | vraj404 Criminal-Management-System 2808d057e7ddc5295519a487365b0cacfd0ba8c4 SQL Injection |
|---|
| Description | The affected component is `Officers/addOfficer.php`, the officer registration form of the Officers directory. All seven form fields are concatenated into an `INSERT` statement without escaping, the page performs no authentication, and database error messages are echoed back to the client:
```php
$offName=$_POST['offName'];
$offID=$_POST['offID'];
$ID=$_POST['ID'];
$contact=$_POST['contact'];
$gender=$_POST['gender'];
$weapon=$_POST['weapon'];
$role=$_POST['role'];
echo $offName;
...
$q1="INSERT INTO `officer`(`offName`, `offID`, `ID`, `contact`, `gender`, `weapon`, `role`) VALUES ('$offName','$offID','$ID','$contact','$gender','$weapon','$role')";
if(mysqli_query($conn,$q1))
{
echo"done";
}
else{
echo mysqli_error($conn);
}
```
The echoed `mysqli_error()` output turns the injection into a trivially exploitable error-based channel. Verified reproduction: `extractvalue()` payloads extracted `users.pass` (`admin`) directly in the error message, with no login required.
|
|---|
| Source | ⚠️ https://github.com/vraj404/Criminal-Management-System/issues/5 |
|---|
| User | Quanqie (UID 101906) |
|---|
| Submission | 10/05/2026 17:27 (23 days ago) |
|---|
| Moderation | 10/19/2026 07:51 (14 days later) |
|---|
| Status | Accepted |
|---|
| VulDB entry | 422260 [vraj404 Criminal-Management-System up to 2808d057e7ddc5295519a487365b0cacfd0ba8c4 Officer Registration Form Officers/addOfficer.php mysqli_error offName/offID/ID/contact/gender/weapon/role sql injection] |
|---|
| Points | 20 |
|---|