CVE-2022-31978
Published: 02 June 2022
Summary
CVE-2022-31978 is a critical-severity SQL Injection (CWE-89) vulnerability in Online Fire Reporting System Project Online Fire Reporting System. Its CVSS base score is 9.8 (Critical).
Operationally, ranked in the top 2.2% of CVEs by exploit likelihood; it is not currently listed in the CISA KEV catalog; a public proof-of-concept is referenced.
Deeper analysis
Online Fire Reporting System v1.0 contains a SQL injection vulnerability in the file /ofrs/classes/Master.php at the delete_inquiry function. The flaw is tracked as CVE-2022-31978 with a CVSS 3.1 score of 9.8 and is classified under CWE-89. It allows unauthenticated attackers to inject arbitrary SQL statements through a network-accessible endpoint.
An attacker with no credentials or user interaction can send a crafted HTTP request to the affected endpoint and achieve full read, write, or delete access to the application's database, potentially compromising confidentiality, integrity, and availability of stored records.
The two referenced GitHub reports document the injection vector but contain no vendor advisory, patch information, or mitigation guidance. The associated EPSS score has remained near 0.48 with no material rise from a low baseline after disclosure.
EU & UK References
- 🇪🇺 ENISA EUVD: EUVD-2022-53259
Vulnerability details
Online Fire Reporting System v1.0 is vulnerable to SQL Injection via /ofrs/classes/Master.php?f=delete_inquiry.
- CWE(s)
Related Threats
No named actor attribution yet. ATT&CK technique mapping in progress for this CVE.
Affected Assets
Mitigating Controls
Likely Mitigating Controls AI
Per-CVE control mapping for this CVE has not run yet; the list below is derived from the weakness types (CWEs) cited in the NVD entry.