{"description":"Trending threats, MITRE ATT\u0026CK coverage, and detection metadata. Fed continuously.","favicon":"https://feed.craftedsignal.io/favicon-32x32.png","feed_url":"https://feed.craftedsignal.io/cpes/cpe2.3avraj404criminal_management_system/feed.json","home_page_url":"https://feed.craftedsignal.io/","icon":"https://feed.craftedsignal.io/apple-touch-icon.png","items":[{"_cs_actors":[],"_cs_cpes":["cpe:2.3:a:vraj404:criminal_management_system:*:*:*:*:*:*:*:*"],"_cs_cves":[{"cvss":7.3,"id":"CVE-2026-112149"}],"_cs_exploited":false,"_cs_has_poc":false,"_cs_poc_references":[],"_cs_products":["Criminal-Management-System (\u003c= 2808d057e7ddc5295519a487365b0cacfd0ba8c4)"],"_cs_severities":["high"],"_cs_tags":["vulnerability","web-application","file-upload","sqli"],"_cs_type":"advisory","_cs_vendors":["vraj404"],"content_html":"\u003cp\u003eA vulnerability has been identified in the vraj404 Criminal-Management-System (up to commit 2808d057e7ddc5295519a487365b0cacfd0ba8c4). The flaw resides in the move_uploaded_file function within the home.php file. By manipulating the my_img argument during a file upload request, an unauthenticated remote attacker can bypass intended file type restrictions, allowing the upload of malicious payloads to the server. Because the project utilizes a rolling release model and has not provided a patch following the issue report, users remain at risk of remote code execution if an attacker successfully uploads and executes a web shell. Public exploit code is available for this vulnerability, significantly increasing the likelihood of exploitation.\u003c/p\u003e\n\u003ch2 id=\"impact\"\u003eImpact\u003c/h2\u003e\n\u003cp\u003eSuccessful exploitation allows a remote attacker to upload arbitrary files to the web server, which can lead to full system compromise if the attacker is able to execute the uploaded script (e.g., a web shell). This vulnerability poses a critical risk to any infrastructure hosting the Criminal-Management-System, as it is remotely exploitable without authentication.\u003c/p\u003e\n\u003ch2 id=\"recommendation\"\u003eRecommendation\u003c/h2\u003e\n\u003col\u003e\n\u003cli\u003eAudit web server logs for HTTP POST requests to home.php containing suspicious file extensions (e.g., .php, .phtml, .php5) in the my_img parameter.\u003c/li\u003e\n\u003cli\u003eImplement strict file extension filtering and input validation on the web server side for all upload endpoints.\u003c/li\u003e\n\u003cli\u003eRestrict write permissions on the directory where uploaded files are stored to prevent web server execution of uploaded content.\u003c/li\u003e\n\u003cli\u003eReview access logs for non-standard file access patterns within the upload directory.\u003c/li\u003e\n\u003c/ol\u003e\n","date_modified":"2026-10-19T16:08:49Z","date_published":"2026-10-19T16:08:41Z","id":"https://feed.craftedsignal.io/briefs/2026-10-criminal-management-system-vulnerability/","summary":"An unrestricted file upload vulnerability in the Criminal-Management-System allows remote attackers to upload arbitrary files via the my_img parameter in home.php.","title":"Unrestricted File Upload Vulnerability in Criminal-Management-System","url":"https://feed.craftedsignal.io/briefs/2026-10-criminal-management-system-vulnerability/"}],"language":"en","title":"CraftedSignal Threat Feed - Cpe:2.3:a:vraj404:criminal_management_system:*:*:*:*:*:*:*:*","version":"https://jsonfeed.org/version/1.1"}