# CVE-2026-112150: vraj404 Criminal-Management-System SQL injection in search.php

Source: https://junglewise.ai/threats/cve-2026-112150-a-security-flaw-has-been-discovered-in-vraj404-criminal  
Publisher: Junglewise Threat Intelligence, https://junglewise.ai/threats  
Published: 2026-10-19. Updated: 2026-10-19  
License: CC BY 4.0 with a link back

CVE-2026-112150 · Severity: high · CVSS 7.3 · Published 2026-10-19

Criminal-Management-System is a police records management application that stores criminal information and officer credentials in a MySQL database. An unauthenticated attacker can inject SQL commands through the search field to read all sensitive data including passwords, criminal records, and personal information, or modify database contents without any authentication required.

Technologies: [Vraj404 Criminal Management System](https://junglewise.ai/threats/technologies/criminal-management-system). Vendors: [Vraj404](https://junglewise.ai/threats/vendors/vraj404).

## Quick answers

**Is CVE-2026-112150 exploited in the wild?** No. Junglewise Threat Intelligence has no report of CVE-2026-112150 being exploited in the wild.

**How severe is CVE-2026-112150?** High severity, with a CVSS score of 7.3, published 19 October 2026.

**Which products and versions are affected?** Vraj404 Criminal Management System up to commit 2808d057e7ddc5295519a487365b0cacfd0ba8c4.

**Is there a fix for CVE-2026-112150?** No fixed version is recorded yet. Apply input validation and use prepared statements (mysqli_prepared_statements) or mysqli_real_escape_string() for all SQL queries. Implement authentication checks on search.php and printable.php to restrict access to authorized users only.</anigation>
<parameter name="timeline">[{"kind":"disclosed","at":"2026-10-05","note":"Security issue reported to project via GitHub issue"},{"kind":"advisory","at":"2026-10-19","note":"CVE-2026-112150 published"}] If you run it, Junglewise drafts a mitigation that fits your setup and applies it once you approve, with senior security engineers behind it.

**How is CVE-2026-112150 attacked?** It is attacked over the network, in a web application.

**Am I affected by CVE-2026-112150?** Check whether you run Vraj404 Criminal Management System at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

## How to fix


Apply input validation and use prepared statements (mysqli_prepared_statements) or mysqli_real_escape_string() for all SQL queries. Implement authentication checks on search.php and printable.php to restrict access to authorized users only.</anigation>
<parameter name="timeline">[{"kind":"disclosed","at":"2026-10-05","note":"Security issue reported to project via GitHub issue"},{"kind":"advisory","at":"2026-10-19","note":"CVE-2026-112150 published"}]

## Technical details

Unauthenticated SQL injection exists in search.php where user input from the POST parameter "search" is concatenated directly into a SELECT query without sanitization, prepared statements, or input validation. The vulnerable data is also stored in the PHP session and reused by printable.php in the same unsanitized manner, providing a second execution point. An attacker can read arbitrary database content, extract credentials, and modify or delete records via UNION-based or boolean-based SQL injection.

## Affected products

- vraj404 Criminal-Management-System up to commit 2808d057e7ddc5295519a487365b0cacfd0ba8c4

## References

- [https://github.com/vraj404/Criminal-Management-System/](https://github.com/vraj404/Criminal-Management-System/)
- [https://github.com/vraj404/Criminal-Management-System/issues/2](https://github.com/vraj404/Criminal-Management-System/issues/2)

## Related threats

- [vraj404 Criminal-Management-System SQL injection in addOfficer.php](https://junglewise.ai/threats/cve-2026-112153-a-vulnerability-was-detected-in-vraj404-criminal-management)
- [vraj404 Criminal-Management-System SQL injection in searchOff.php](https://junglewise.ai/threats/cve-2026-112152-a-security-vulnerability-has-been-detected-in-vraj404-criminal)
- [vraj404 Criminal Management System SQL injection in home.php](https://junglewise.ai/threats/cve-2026-112151-a-weakness-has-been-identified-in-vraj404-criminal-management)
- [vraj404 Criminal-Management-System unrestricted file upload](https://junglewise.ai/threats/cve-2026-112149-a-vulnerability-was-identified-in-vraj404-criminal-management)