CVE-2026-112150: SQL Injection in vraj404 Criminal-Management-System

This vulnerability involves an SQL injection flaw in an unspecified function within the search.php file of the vraj404 Criminal-Management-System. Attackers can remotely exploit the Search parameter to inject malicious SQL commands. The product's rolling release model prevents precise version identification for affected or fixed releases. The vulnerability was responsibly disclosed but remains unpatched as of the publication date. Public exploit code has been released, indicating potential for exploitation.

Successful exploitation could allow remote attackers to execute arbitrary SQL commands on the backend database with low attack complexity and no privileges or user interaction required. The vulnerability has low confidentiality, integrity, and availability impacts, suggesting limited but non-negligible risk. The availability of public exploit code increases the likelihood of exploitation attempts.

No official fix or patch is currently available, and the vendor has not responded to the issue report. Users should monitor the vendor's communications for updates. Until a patch is released, consider implementing web application firewall (WAF) rules to detect and block SQL injection attempts targeting the Search parameter in search.php.