A critical SQL injection vulnerability in the Digital Crime Report Management System allows unauthenticated attackers to bypass authentication and gain unauthorized access to the application.

This vulnerability is a classic SQL injection (CWE-89) triggered via crafted payloads in the email and password parameters of the police, incharge, user, and HQ login endpoints. An unauthenticated attacker can manipulate these input fields to bypass the authentication mechanism entirely.

The ability for an unauthenticated attacker to bypass authentication poses a severe risk to the confidentiality and integrity of sensitive crime report data. With a CVSS score of 8.2, this vulnerability could lead to total unauthorized access to the system, potentially resulting in data exfiltration, unauthorized modification of records, and significant reputational damage to the organization using the software.

Immediate Action: As no official patch is currently available, administrators should restrict access to the application login pages using network-level controls or by disabling the affected modules until the vendor provides a secure update.

Proactive Monitoring: Review web server and application access logs for anomalous POST requests to login endpoints containing SQL special characters, such as single quotes or boolean logic strings.

Compensating Controls: Deploy a Web Application Firewall (WAF) with rules configured to detect and block SQL injection patterns specifically targeting the identified login endpoints.

Public Exploit Available: Yes, a functional exploit is available via the Exploit-DB entry 49761.

Given the availability of a public exploit and the ease of execution, this vulnerability represents a high risk to any environment hosting the Digital Crime Report Management System. Organizations must treat this as a critical priority, implement immediate access restrictions, and seek an alternative solution if the vendor does not provide a definitive security update.