Criminal Management System CVE-2026-112150

Exploitation requires only that the application's search.php page be network-reachable and that a value be supplied in the 'Search' parameter, which is attacker-controlled on a default install - no authentication (PR:N), no user interaction (UI:N), and no special configuration are needed. The only meaningful limiting factor is deployment scope: this is a niche open-source Criminal-Management-System project with a rolling release and no released versions, so exposure depends entirely on an organization actually self-hosting this specific PHP application and exposing it to the attacker's network path. Impact is bounded to low confidentiality, integrity, and availability on the vulnerable system, indicating a single injectable parameter rather than full administrative database takeover.

Signals are mixed and point to a low-to-moderate real-world priority despite the CVSS 4.0 base score of 6.9. The CVSS 4.0 vector (AV:N/AC:L/AT:N/PR:N/UI:N) describes a remotely reachable, low-complexity, unauthenticated SQL injection, and the embedded E:P indicates only a proof-of-concept maturity - not active exploitation. A public exploit exists (the VulDB-referenced GitHub issue), which raises opportunistic risk, but there is NO CISA KEV listing and NO EPSS score was supplied, so widespread or automated exploitation cannot be asserted from the data. The impact metrics are deliberately modest (VC:L/VI:L/VA:L, no subsequent-system impact), consistent with a single injectable search parameter rather than full database compromise or RCE. The decisive mitigating factor is the target: vraj404 Criminal-Management-System is an open-source hobby/student project delivered as a rolling release with no versioning, so real-world deployment is minimal. Net assessment: a genuine, publicly-exploitable flaw, but low practical priority outside of anyone actually running this specific project; treat it as high-CVSS-relative-to-footprint rather than an urgent fleet-wide threat. Note the conflict: the project was notified via issue report but has not responded, so no fix is confirmed available.

A remote, unauthenticated attacker submits a crafted value in the 'Search' parameter of search.php, injecting SQL that the application concatenates into a backend query. Because a public proof-of-concept already exists (referenced in the project's GitHub issue tracker), an attacker can adapt it directly to enumerate or manipulate database contents. Given AC:L and PR:N, no special timing, privileges, or user interaction is needed.