vendor:
Digital Crime Report Management System
by:
Galuh Muhammad Iman Akbar (GaluhID)
9.8
CVSS
HIGH
SQL Injection
89
CWE
Product Name: Digital Crime Report Management System
Affected Version From: 1.0
Affected Version To: 1.0
Patch Exists: NO
Related CWE: N/A
CPE: a:iwantsourcecodes:digital_crime_report_management_system
Metasploit:
N/A
Other Scripts:
N/A
Platforms Tested: N/A
2021
Digital Crime Report Management System 1.0 – SQL Injection (Authentication Bypass)
I Found SQL Injection in 4 Page Login (Police Login page, Incharge Login page, User Login & HQ Login). The exploit is triggered by sending a maliciously crafted POST request to the vulnerable page with the payload 'email='or''='&password='or''='&s='. This payload allows the attacker to bypass authentication and gain access to the application.
Mitigation:
Input validation should be implemented to prevent malicious payloads from being sent to the application. Additionally, authentication should be done using secure methods such as OAuth.
