CVE-2022-31981
Published: 02 June 2022
Summary
CVE-2022-31981 is a high-severity SQL Injection (CWE-89) vulnerability in Online Fire Reporting System Project Online Fire Reporting System. Its CVSS base score is 7.2 (High).
Operationally, ranked in the top 6.6% of CVEs by exploit likelihood; it is not currently listed in the CISA KEV catalog; a public proof-of-concept is referenced.
Deeper analysis
Online Fire Reporting System version 1.0 contains a SQL injection vulnerability, tracked as CVE-2022-31981 and assigned CWE-89, that affects the administrative endpoint /ofrs/admin/?page=teams/view_team&id=. The flaw permits unsanitized input to be passed directly into database queries, producing a CVSS 3.1 base score of 7.2 that reflects network attack vector, low complexity, and high impact on confidentiality, integrity, and availability.
An authenticated administrator can supply crafted input through the affected parameter to execute arbitrary SQL statements. Successful exploitation grants the attacker the ability to read, modify, or delete database contents and potentially escalate to full control of the application and underlying data.
The two referenced GitHub reports document the injection vector but contain no vendor advisory, patch information, or mitigation guidance. The associated EPSS score has remained flat at 0.1048 with no material increase since disclosure.
EU & UK References
- 🇪🇺 ENISA EUVD: EUVD-2022-53261
Vulnerability details
Online Fire Reporting System v1.0 is vulnerable to SQL Injection via /ofrs/admin/?page=teams/view_team&id=.
- CWE(s)
Related Threats
No named actor attribution yet. ATT&CK technique mapping in progress for this CVE.
Affected Assets
Mitigating Controls
Likely Mitigating Controls AI
Per-CVE control mapping for this CVE has not run yet; the list below is derived from the weakness types (CWEs) cited in the NVD entry.