This vulnerability arises from an unspecified feature in the home.php submission form of the Criminal Management System, allowing an attacker to manipulate various form parameters including id, name, crime, date of birth, and address fields to inject arbitrary SQL statements. The injection can occur remotely, as the form is exposed over the network, and it may allow attackers to read, modify, or delete sensitive data stored in the database. The weakness corresponds to CWE-74 (Improper Handling of Embedded Format and Embedded Strings) and CWE-89 (SQL Injection).

The affected product is the Criminal Management System developed by vraj404. Versions up to the commit identified as 2808d057e7ddc5295519a487365b0cacfd0ba8c4 are vulnerable. Because the project follows a rolling release schedule, precise affected version ranges cannot be listed beyond this snapshot, and no updated release has been identified yet.

The CVSS score of 6.9 indicates a moderate severity vulnerability. EPSS information is not available, and the issue is not currently listed in the CISA KEV catalog. The remote nature of the attack vector and the public availability of exploiting code elevate the risk to environments that host this application. Attackers could exploit the vulnerability without authentication, potentially leading to unauthorized data access or corruption. In the absence of an official patch, the likelihood of exploitation remains significant if proper defensive controls are not implemented.