Criminal Management System CVE-2026-112149

Exploitation requires that the Criminal-Management-System application be deployed and reachable, with the home.php image-upload feature (the 'my_img' parameter passed to move_uploaded_file) accessible to the attacker. Per the supplied CVSS vector (PR:N/UI:N), no authentication or user interaction is indicated, implying the upload handler is reachable without credentials in the assessed configuration; however, this should be verified because many management applications gate upload pages behind a login, and the vendor's own vector was not independently confirmed. The decisive limiting factor is deployment scope: this is a niche single-developer PHP project with essentially no production presence, so exploitation is realistic only against the small set of environments actually running it. No fixed release exists (rolling release, unmaintained), so all current deployments from the referenced commit are exposed.

This is a CWE-434 unrestricted file upload in the move_uploaded_file call handling the 'my_img' argument in home.php of vraj404's Criminal-Management-System. The provided CVSS 4.0 vector (AV:N/AC:L/AT:N/PR:N/UI:N) describes network-reachable, low-complexity, unauthenticated exploitation with no user interaction, which on paper is high-opportunity. However, the impact metrics are all Low (VC:L/VI:L/VA:L, no subsequent-system impact), producing a moderate 6.9 base score, and the exploit maturity is only E:P (Proof-of-Concept), consistent with a publicly posted PoC rather than mature weaponization. Signals conflict in two ways worth flagging: (1) CWE-434 unrestricted upload typically enables webshell deployment and remote code execution, which would justify far higher than VC:L/VI:L/VA:L - the vendor-assigned Low impacts appear conservative and should be verified, since real-world impact could be code execution. (2) No EPSS score and no CISA KEV listing are provided, so there is no evidence of widespread or active exploitation; the only exploitation signal is a PoC referenced in a GitHub issue. Priority is tempered primarily by product obscurity: this is a hobby/student GitHub project with negligible production footprint, so despite the easy-to-exploit profile, real-world risk is low for most organizations and relevant only to anyone who has actually deployed this specific application.

A remote, unauthenticated attacker sends a crafted POST request to home.php supplying a malicious file in the 'my_img' parameter; because the upload is unrestricted (CWE-434), the attacker uploads a PHP script instead of an image and then requests it to execute arbitrary code in the web server context. A proof-of-concept is publicly available via the project's GitHub issue tracker, lowering the barrier to reproduction.