CVE-2022-31975
Published: 02 June 2022
Summary
CVE-2022-31975 is a high-severity SQL Injection (CWE-89) vulnerability in Online Fire Reporting System Project Online Fire Reporting System. Its CVSS base score is 7.2 (High).
Operationally, ranked in the top 4.8% of CVEs by exploit likelihood; it is not currently listed in the CISA KEV catalog; a public proof-of-concept is referenced.
Deeper analysis
Online Fire Reporting System v1.0 is vulnerable to SQL injection at the administrative endpoint /ofrs/admin/?page=user/manage_user&id=. The issue is tracked as CVE-2022-31975, assigned CWE-89, and rated 7.2 under CVSS 3.1 with network attack vector, low complexity, and high impact on confidentiality, integrity, and availability when successful.
An authenticated user holding administrative privileges can supply malicious input via the id parameter to alter the generated SQL query. This permits reading or modifying arbitrary database contents and may lead to further system-level access depending on database permissions and server configuration.
The two referenced GitHub reports document the injection vector in detail but contain no information on vendor patches, workarounds, or official advisories.
EPSS for the CVE has stayed essentially flat at approximately 0.175 with a peak of 0.176, indicating no material post-disclosure rise in observed exploitation interest.
EU & UK References
- 🇪🇺 ENISA EUVD: EUVD-2022-53256
Vulnerability details
Online Fire Reporting System v1.0 is vulnerable to SQL Injection via /ofrs/admin/?page=user/manage_user&id=.
- CWE(s)
Related Threats
No named actor attribution yet. ATT&CK technique mapping in progress for this CVE.
Affected Assets
Mitigating Controls
Likely Mitigating Controls AI
Per-CVE control mapping for this CVE has not run yet; the list below is derived from the weakness types (CWEs) cited in the NVD entry.