CVE-2022-31976

CRITICALNuclei

Online Fire Reporting System v1.0 - SQL injection

Title source: github.com
STIX 2.1 vulnerability

Record summary

CVE-2022-31976 has a selected CVSS score of 9.8 (critical); EIP currently links 1 Nuclei template.

Description

Online Fire Reporting System v1.0 is vulnerable to SQL Injection via /ofrs/classes/Master.php?f=delete_request.

Description source: CVE List

Exploitation context

Available material

Nuclei templates
1

Nuclei templates

1
ProjectDiscoveryCRITICALOnline Fire Reporting System v1.0 - SQL injectionCVSS 9.8

Online Fire Reporting System v1.0 is vulnerable to SQL Injection via /ofrs/classes/Master.php?f=delete_request.

Impact

Successful exploitation of this vulnerability could allow an attacker to execute arbitrary SQL queries, potentially leading to unauthorized access, data leakage, or data manipulation.

Remediation

To remediate this vulnerability, ensure that all user-supplied input is properly validated and sanitized before being used in SQL queries.

WeaknessesCWE-89
Authorstheamanrawat
Template tagstime-based-sqlicvecve2022sqlionline-fire-reportingonline_fire_reporting_system_projectvuln
CVSS vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
CPE: cpe:2.3:a:online_fire_reporting_system_project:online_fire_reporting_system:1.0:*:*:*:*:*:*:*
https://github.com/debug601/bug_report/blob/main/vendors/oretnom23/online-fire-reporting-system/SQLi-4.md https://www.sourcecodester.com/php/15346/online-fire-reporting-system-phpoop-free-source-code.html https://nvd.nist.gov/vuln/detail/CVE-2022-31976

Source: ProjectDiscovery

References

2