Criminal Management System CVE-2026-112153

Exploitation requires network access to a deployed instance of vraj404 Criminal-Management-System and the ability to submit the Officer Registration Form at Officers/addOfficer.php; the attacker supplies a malicious value in any of the parameters offName, offID, ID, contact, gender, weapon, or role, which flow unsanitized into a MySQL query. The vendor marks this unauthenticated (PR:N), but a limiting factor to verify is whether the add-officer endpoint is actually reachable without an officer/admin session - if it sits behind the application login, a valid account would be a prerequisite. The primary real-world limiter is deployment: this is an obscure personal project with essentially no production presence, and because it is a rolling release there is no patched version to reference.

This is a classic CWE-89 SQL injection in an unauthenticated-reachable input (per the vendor CVSS 4.0 vector AV:N/AC:L/PR:N/UI:N), with publicly available exploit code (VulDB reports a public exploit and references a GitHub issue flagged as 'exploit'). Exploit maturity is Proof-of-Concept (E:P), and there is NO CISA KEV listing and NO EPSS score provided, so there is no evidence of active or widespread exploitation - the POC signal and the KEV/EPSS signals point to a low real-world exploitation likelihood despite easy exploitability. The vendor-assigned CVSS 4.0 base score of 6.9 (MEDIUM) is driven by low-but-present impact on all three dimensions (VC:L/VI:L/VA:L); this is conservative for a SQL injection, which can frequently yield full database read/write, so the technical impact may be understated. The dominant mitigating factor is prevalence: this is a hobby/personal GitHub project (vraj404/Criminal-Management-System), not enterprise software, so the real-world attack surface is minimal. Net assessment: technically trivial to exploit with a public POC, but a LOW operational priority for most defenders because deployment footprint is negligible; it matters only to the handful of parties actually running this specific project. One conflict to verify: the vendor rates PR:N (unauthenticated), yet an 'Officer Registration Form' in a management system would typically sit behind an admin/officer login - verify whether the endpoint is truly reachable pre-authentication.

A remote attacker sends a crafted HTTP request to Officers/addOfficer.php, placing a SQL injection payload in one of the vulnerable form parameters (offName, offID, ID, contact, gender, weapon, or role). Because the input is concatenated into a query handled by mysqli_error, the attacker manipulates the backend query to read, alter, or dump database records. A public proof-of-concept exists (referenced via the project's GitHub issue tracker), lowering the skill required to reproduce the attack.