CVE-2021-47846: Digital Crime Report Management SQL Injection

CVE-2021-47846 Overview

Digital Crime Report Management System 1.0 contains a critical SQL injection vulnerability affecting multiple login pages that allows unauthenticated attackers to bypass authentication. Attackers can exploit the vulnerability by sending crafted SQL injection payloads in email and password parameters across police, incharge, user, and HQ login endpoints.

Critical Impact

Unauthenticated attackers can bypass authentication on multiple login endpoints, potentially gaining unauthorized access to sensitive criminal report data and administrative functions.

Affected Products

• Digital Crime Report Management System 1.0
• Police login endpoint (police_login.php)
• Incharge login endpoint (incharge_login.php)
• User login endpoint (user_login.php)
• HQ login endpoint (hq_login.php)

Discovery Timeline

• 2026-01-21 - CVE CVE-2021-47846 published to NVD
• 2026-01-21 - Last updated in NVD database

Technical Details for CVE-2021-47846

Vulnerability Analysis

This SQL injection vulnerability (CWE-89) exists in Digital Crime Report Management System 1.0 due to improper input validation in multiple authentication endpoints. The application fails to properly sanitize user-supplied input in the email and password parameters before incorporating them into SQL queries. This allows attackers to inject malicious SQL code that can manipulate database queries, leading to authentication bypass.

The vulnerability is particularly severe because it affects multiple login endpoints simultaneously—police, incharge, user, and HQ login pages—indicating a systemic failure in secure coding practices across the application. An unauthenticated attacker can exploit this vulnerability remotely without any user interaction, making it highly accessible for exploitation.

Root Cause

The root cause of this vulnerability is the direct concatenation of user-supplied input into SQL queries without proper parameterization or input sanitization. The PHP application constructs authentication queries by directly embedding the email and password values submitted through login forms, allowing attackers to manipulate the query logic through specially crafted input.

Attack Vector

The attack vector is network-based, requiring no authentication or user interaction. An attacker can exploit this vulnerability by submitting crafted SQL injection payloads through the login forms. Classic authentication bypass payloads such as ' OR '1'='1 or ' OR 1=1-- in the email or password fields can manipulate the SQL query logic to return a true condition, effectively bypassing the authentication mechanism.

The attack can be executed against any of the four vulnerable login endpoints:

• /police_login.php
• /incharge_login.php
• /user_login.php
• /hq_login.php

Successful exploitation grants the attacker unauthorized access to the corresponding administrative or user interface, depending on which endpoint is targeted.

Detection Methods for CVE-2021-47846

Indicators of Compromise

• Unusual login patterns with SQL syntax characters (', ", --, ;, OR, AND) in authentication logs
• Successful authentication events without corresponding valid user credentials
• Multiple failed login attempts followed by sudden successful authentication from the same source
• Web server logs showing requests to login endpoints containing URL-encoded SQL keywords

Detection Strategies

• Deploy Web Application Firewall (WAF) rules to detect and block SQL injection patterns in POST parameters
• Implement database activity monitoring to identify anomalous query patterns characteristic of SQL injection
• Configure intrusion detection systems (IDS) with signatures for common SQL injection payloads
• Enable verbose logging on authentication endpoints to capture full request parameters for forensic analysis

Monitoring Recommendations

• Monitor authentication logs for login attempts containing special characters or SQL keywords
• Set up alerts for successful logins from unusual geographic locations or IP addresses
• Track database query execution times, as SQL injection attacks may cause unusual query performance
• Review access logs for the affected login endpoints (police_login.php, incharge_login.php, user_login.php, hq_login.php) regularly

How to Mitigate CVE-2021-47846

Immediate Actions Required

• Restrict network access to the Digital Crime Report Management System to trusted IP addresses only
• Implement a Web Application Firewall (WAF) with SQL injection detection rules in front of the application
• Consider taking the application offline if it processes sensitive criminal data until a patch can be applied
• Audit database access logs for any evidence of unauthorized access or data exfiltration

Patch Information

No official vendor patch has been identified for this vulnerability. The Digital Crime Report Management System is an open-source PHP application, and users should review the VulnCheck SQL Injection Advisory and Exploit-DB #49761 for technical details. Organizations using this software should implement the workarounds below and consider migrating to a more actively maintained alternative.

Workarounds

• Implement prepared statements (parameterized queries) in all database queries handling user input
• Add server-side input validation to reject email and password inputs containing SQL metacharacters
• Deploy a reverse proxy with ModSecurity or similar WAF capabilities to filter malicious requests
• Implement rate limiting on login endpoints to slow down automated exploitation attempts
• Use network segmentation to isolate the application server from sensitive database systems

# Example ModSecurity rule to block SQL injection in login parameters
SecRule ARGS:email|ARGS:password "@detectSQLi" \
    "id:1001,phase:2,deny,status:403,msg:'SQL Injection Detected in Login Parameters'"