CVE-2022-31977
Published: 02 June 2022
Summary
CVE-2022-31977 is a critical-severity SQL Injection (CWE-89) vulnerability in Online Fire Reporting System Project Online Fire Reporting System. Its CVSS base score is 9.8 (Critical).
Operationally, ranked in the top 2.7% of CVEs by exploit likelihood; it is not currently listed in the CISA KEV catalog; a public proof-of-concept is referenced.
Deeper analysis
Online Fire Reporting System v1.0 is affected by a SQL injection vulnerability (CWE-89) located in the delete_team endpoint at /ofrs/classes/Master.php?f=delete_team. The flaw carries a CVSS 3.1 score of 9.8, reflecting network-accessible, unauthenticated exploitation with no required user interaction that can fully compromise confidentiality, integrity, and availability.
An attacker can supply crafted input to the vulnerable parameter and execute arbitrary SQL commands against the underlying database. Because the endpoint does not require authentication, remote, unauthenticated actors are able to read, modify, or delete data and potentially escalate to broader system control.
Public references consist of a detailed proof-of-concept report on GitHub that reproduces the injection; no official vendor advisory or patch information is included in the available sources. The associated EPSS score has remained essentially flat near 0.38 with only a negligible peak difference, providing no indication of a post-disclosure rise in observed exploitation activity.
EU & UK References
- 🇪🇺 ENISA EUVD: EUVD-2022-53258
Vulnerability details
Online Fire Reporting System v1.0 is vulnerable to SQL Injection via /ofrs/classes/Master.php?f=delete_team.
- CWE(s)
Related Threats
No named actor attribution yet. ATT&CK technique mapping in progress for this CVE.
Affected Assets
Mitigating Controls
Likely Mitigating Controls AI
Per-CVE control mapping for this CVE has not run yet; the list below is derived from the weakness types (CWEs) cited in the NVD entry.