CVE-2026-112153: SQL Injection in vraj404 Criminal-Management-System

The vulnerability CVE-2026-112153 affects vraj404 Criminal-Management-System up to commit 2808d057e7ddc5295519a487365b0cacfd0ba8c4. It is an SQL injection flaw in the Officer Registration Form's addOfficer.php file, specifically in the mysqli_error function. Attackers can remotely exploit this by manipulating multiple input arguments, potentially allowing unauthorized database queries. The product's rolling release model means no discrete version numbers are provided for affected or patched releases. The issue was reported early to the project, but no vendor response or patch has been published yet. The CVSS 4.0 base score is 6.9, indicating medium severity with network attack vector, low complexity, no privileges or user interaction required, and low to limited impact on confidentiality, integrity, and availability.

Successful exploitation of this SQL injection vulnerability could allow an attacker to execute arbitrary SQL commands on the backend database remotely. This may lead to unauthorized data access, modification, or deletion within the Criminal-Management-System database. The impact is rated medium based on CVSS 4.0 scoring, reflecting limited but non-negligible confidentiality, integrity, and availability impacts. No known exploits are currently observed in the wild.

No official fix or patch has been released by the vendor as of now. Since the product uses a rolling release model and no updated releases are available, users should monitor the vendor's channels for any forthcoming patches or advisories. Until a fix is provided, restricting access to the vulnerable component and implementing web application firewall (WAF) rules to detect and block SQL injection attempts may help mitigate risk. Avoid exposing the Officer Registration Form to untrusted networks if possible.