The Criminal-Management-System’s search.php contains a flaw where the Search parameter can be manipulated to inject SQL code. This vulnerability, classified as CWE-74 and CWE-89, allows an attacker to send a crafted request from any remote host. If successful, the attacker can read, modify, delete, or otherwise compromise the underlying database, exposing sensitive criminal records or allowing further lateral movement within the system. Affected systems are all releases of the vraj404 Criminal-Management-System up to commit 2808d057e7ddc5295519a487365b0cacfd0ba8c4. The project uses a rolling release model, so version information for fixed releases is unavailable; any older build is potentially vulnerable until a patch is applied. The CVSS score of 6.9 indicates a moderate severity, and the EPSS score is not provided, yet the exploit has already been released publicly and is likely to be used by threat actors. The vulnerability is not listed in CISA’s KEV catalog, but the lack of an official fix and remote exploitation route mean that the risk to organizations hosting the application remains significant.

All builds of the Criminal-Management-System project from vraj404, including the package indexed as vraj404:Criminal-Management-System. The vulnerability exists in the search.php component of the application, affecting all deployed instances of the system that have not applied a fixed commit.

With a CVSS score of 6.9 the risk is moderate, but the publicly available exploit and remote nature elevate the practical danger. An attacker can trigger the injection by sending a specially crafted query string to search.php from any external host, bypassing authentication in many cases. Because the product follows a rolling release model, there is no clear versioning of fixes, thus the system may remain vulnerable until a patch is released. The absence of an EPSS score does not diminish the fact that exploit code is already in circulation, indicating a high likelihood of real-world attacks.