A SQL injection flaw exists in the addOfficer.php component of the Criminal‑Management‑System, allowing an attacker to inject arbitrary SQL by manipulating fields such as offName, offID, ID, contact, gender, weapon, or role. The injected input is passed directly to the mysqli_error function without proper sanitization, creating a vulnerability that falls under CWE‑89 (SQL Injection) and includes characteristics of CWE‑74 (Injection flaw). Successful exploitation could read, modify, or delete any officer data in the database, impacting the confidentiality, integrity, or availability of the system.

All instances of the Criminal‑Management‑System distributed by vraj404 that include the addOfficer.php script before the commit 2808d057e7ddc5295519a487365b0cacfd0ba8c4 are affected. Because the project uses a rolling release model, version numbers are not published, but any build created from source prior to that commit remains vulnerable.

The CVSS score of 6.9 places this flaw in the moderate severity range. The attack can be carried out remotely without authentication and public exploits are already available. Although the EPSS score is not disclosed and the vulnerability is not listed in the CISA KEV catalog, the lack of a vendor response and the presence of an existing exploit raise the likelihood that unpatched systems will be affected.