CVE-2026-112153: vraj404 Criminal-Management-System Officer Registration Form addOfficer.php mysqli_error sql injection
A vulnerability was detected in vraj404 Criminal-Management-System up to 2808d057e7ddc5295519a487365b0cacfd0ba8c4. This affects the function mysqlierror of the file Officers/addOfficer.php of the component Officer Registration Form. Performing a manipulation of the argument offName/offID/ID/contact/gender/weapon/role results in sql injection. It is possible to initiate the attack remotely. The exploit is now public and may be used. This product is using a rolling release to provide continious delivery. Therefore, no version details for affected nor updated releases are available. The project was informed of the problem early through an issue report but has not responded yet.
Affected Software
Event History
Frequently Asked Questions
Which inputs are implicated in the SQL injection?
The affected Officer Registration Form handler, Officers/addOfficer.php, is vulnerable when the offName, offID, ID, contact, gender, weapon, or role arguments are manipulated.
Does exploitation require authentication or user interaction?
The supplied severity vector indicates network access, low attack complexity, no privileges required, and no user interaction. The issue can be initiated remotely.
How can I determine whether my deployment is affected?
Check whether your deployment includes the Officer Registration Form endpoint at Officers/addOfficer.php and accepts the listed input arguments. The advisory identifies affected source revisions up to commit 2808d057e7ddc5295519a487365b0cacfd0ba8c4; no fixed release version is provided because the project uses rolling releases.
Is public exploit material available?
Yes. The advisory states that an exploit is public and may be used.
Is a vendor fix available?
No updated release or fixed version is identified. The project was reportedly notified through an issue report but had not responded at the time of the advisory.