CVE-2022-31980
Published: 02 June 2022
Summary
CVE-2022-31980 is a high-severity SQL Injection (CWE-89) vulnerability in Online Fire Reporting System Project Online Fire Reporting System. Its CVSS base score is 7.2 (High).
Operationally, ranked in the top 6.6% of CVEs by exploit likelihood; it is not currently listed in the CISA KEV catalog; a public proof-of-concept is referenced.
Deeper analysis
Online Fire Reporting System v1.0 is vulnerable to SQL injection in its administrative interface. The flaw exists at the endpoint /ofrs/admin/?page=teams/manage_team&id=, where unsanitized input is passed directly into database queries, corresponding to CWE-89. The issue received a CVSS 3.1 score of 7.2, reflecting network attack vector, low attack complexity, and high impact on confidentiality, integrity, and availability when successfully exploited.
An authenticated user with administrative privileges can supply crafted input to the affected parameter and execute arbitrary SQL statements against the backend database. Successful exploitation allows an attacker to read, modify, or delete stored data, and potentially escalate to operating-system level access depending on database configuration and privileges.
The EPSS score for this CVE has remained flat at 0.1048 with no material upward trajectory after disclosure. Public references consist of a GitHub proof-of-concept report that documents the injection vector but contain no vendor advisory or patch information.
EU & UK References
- 🇪🇺 ENISA EUVD: EUVD-2022-53260
Vulnerability details
Online Fire Reporting System v1.0 is vulnerable to SQL Injection via /ofrs/admin/?page=teams/manage_team&id=.
- CWE(s)
Related Threats
No named actor attribution yet. ATT&CK technique mapping in progress for this CVE.
Affected Assets
Mitigating Controls
Likely Mitigating Controls AI
Per-CVE control mapping for this CVE has not run yet; the list below is derived from the weakness types (CWEs) cited in the NVD entry.