CVE-2026-112152: SQL Injection in vraj404 Criminal-Management-System

This vulnerability in vraj404 Criminal-Management-System up to commit 2808d057e7ddc5295519a487365b0cacfd0ba8c4 allows remote attackers to perform SQL injection via the Search parameter in the Officers/searchOff.php file, specifically in the mysqli_query function of the Search Page component. The product's rolling release model means versioning details for affected or patched releases are not provided. The vulnerability was responsibly disclosed early but remains unpatched at the time of reporting. Public exploit code exists, increasing the risk of exploitation.

Successful exploitation of this SQL injection vulnerability can allow an unauthenticated remote attacker to manipulate database queries, potentially leading to unauthorized data access or modification. The CVSS 4.0 base score of 6.9 reflects a medium severity with network attack vector, low complexity, no privileges or user interaction required, and limited confidentiality, integrity, and availability impacts. No known active exploitation in the wild has been reported.

No official fix or patch is currently available as the vendor has not responded to the issue report. Users should monitor the vendor's communications for updates. Until a fix is released, consider implementing web application firewall (WAF) rules to detect and block SQL injection attempts targeting the Search parameter. Avoid exposing the vulnerable component to untrusted networks if possible. Patch status is not yet confirmed — check the vendor advisory for current remediation guidance.