Criminal Management System EUVD-2026-104394

Exploitation requires that the vulnerable Search Page (Officers/searchOff.php) of the Criminal-Management-System application be deployed and network-reachable, with the 'Search' input field exposed. Per the CVSS vector (AV:N/AC:L/PR:N/UI:N) no authentication, no user interaction, and no special non-default configuration are required - an attacker only needs HTTP access to the search endpoint. The primary limiting factors are not technical barriers but exposure: the application must be publicly accessible, and because the product is a niche open-source project the realistic attack surface is very small. Because the vendor uses a rolling release and has not responded, no patched version is available, so the only mitigations are removing/restricting the endpoint or applying parameterized-query fixes manually.

This is a classic unauthenticated remote SQL injection (CWE-89) in an obscure open-source PHP project, and the signals point to a moderate real-world priority rather than an urgent one. The CVSS 4.0 vector (AV:N/AC:L/AT:N/PR:N/UI:N) confirms network-reachable, low-complexity, unauthenticated exploitation requiring no user interaction, which is the easy end of the exploitability spectrum; however VulDB assessed only Low impact across all three dimensions (VC:L/VI:L/VA:L), yielding a 6.9 Medium score. The exploit-maturity metric E:P (Proof-of-Concept) and the input flag of a publicly available POC are consistent with one another, so publicly available exploit code exists but there is no indication of mass or automated exploitation. No EPSS score was provided in the input, and the CVE is NOT in CISA KEV, so there is no confirmed active exploitation. The practical risk ceiling is set by the target population, not the flaw: this is a hobby/student-grade GitHub application with negligible production footprint, so despite trivial exploitability this should be triaged well below similar flaws in widely deployed software. One point to verify: VulDB rated confidentiality impact only Low, but an unauthenticated SQL injection in a search field commonly permits full database extraction, which would justify a higher confidentiality impact - see assessed vector below.

A remote, unauthenticated attacker sends a crafted value in the 'Search' parameter to Officers/searchOff.php, where it is concatenated into a mysqli_query call, injecting arbitrary SQL. Because no authentication or user interaction is required and attack complexity is low, the attacker can enumerate and extract database contents (e.g., officer or case records, credentials) directly over the network. A public proof-of-concept is referenced in the project's GitHub issue tracker, lowering the skill needed to reproduce the attack.