---
id: "CVE-2026-112150"
kind: "vulnerability"
aliases: ["CVE-2026-112150"]
title: "Criminal-Management-System: SQL injection in search.php lets remote attackers query data"
severity: "high"
cvss: 7.5
epss: null
exploited: false
status: "open"
category: "other"
products: []
ecosystems: []
tags: ["mysql", "other", "php", "self-hosted"]
not_affected_if: ["internal-only", "not-deployed"]
published_at: "2026-10-19T15:17:05+00:00"
first_seen_at: "2026-10-23T21:57:18+00:00"
updated_at: "2026-10-25T03:23:02+00:00"
sources: [{"source": "nvd", "url": "https://nvd.nist.gov/vuln/detail/CVE-2026-112150", "first_seen_at": "2026-10-23T21:57:18+00:00"}]
---

# Criminal-Management-System: SQL injection in search.php lets remote attackers query data

The vraj404 Criminal-Management-System has an SQL injection flaw in search.php where the Search argument is not sanitized. A remote attacker can alter database queries to read or change the application's data.

_Summary, check and fix written by a model from the sources; labelled as such._

## How to check

- Check whether the deployment includes search.php and whether it passes the Search request parameter into a SQL query, e.g. `grep -n "search" search.php`
- Compare the deployed commit with `2808d057e7ddc5295519a487365b0cacfd0ba8c4`; the sources say the project is rolling release with no version info, so this commit is the only reference

## Fix

- No fixed version is published; the project has not responded to the report. unknown
- Restrict access to the application or take search.php offline until a patch or a parameterized query fix is applied

## Timeline

- 2026-10-23T21:57:18+00:00 nvd https://nvd.nist.gov/vuln/detail/CVE-2026-112150

## From the sources

A security flaw has been discovered in vraj404 Criminal-Management-System up to 2808d057e7ddc5295519a487365b0cacfd0ba8c4. Affected is an unknown function of the file search.php. The manipulation of the argument Search results in sql injection. The attack can be executed remotely. The exploit has been released to the public and may be used for attacks. This product implements a rolling release for ongoing delivery, which means version information for affected or updated releases is unavailable. The project was informed of the problem early through an issue report but has not responded yet.

---

_Free to read at a human pace. An API with keys and an MCP server are in preparation; early access: hello@infrastack.ai_