CVE-2022-31982
Published: 02 June 2022
Summary
CVE-2022-31982 is a high-severity SQL Injection (CWE-89) vulnerability in Online Fire Reporting System Project Online Fire Reporting System. Its CVSS base score is 7.2 (High).
Operationally, ranked in the top 6.6% of CVEs by exploit likelihood; it is not currently listed in the CISA KEV catalog; a public proof-of-concept is referenced.
Deeper analysis
Online Fire Reporting System v1.0 contains a SQL injection vulnerability (CWE-89) that affects the endpoint /ofrs/admin/?page=requests/view_request&id=. The flaw allows an attacker to inject arbitrary SQL through the id parameter, as documented in the public bug report published alongside CVE-2022-31982 on 2022-06-02. The issue carries a CVSS 3.1 base score of 7.2 with the vector AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H.
An authenticated administrator can exploit the vulnerability over the network with low attack complexity. Successful exploitation grants the attacker full read, write, and delete access to the underlying database, enabling data exfiltration, modification of records, or disruption of the application.
The two referenced GitHub reports detail the injection vector but contain no vendor advisory, patch information, or mitigation guidance. The associated EPSS score has remained flat at 0.1048 with no material increase since disclosure.
EU & UK References
- 🇪🇺 ENISA EUVD: EUVD-2022-53262
Vulnerability details
Online Fire Reporting System v1.0 is vulnerable to SQL Injection via /ofrs/admin/?page=requests/view_request&id=.
- CWE(s)
Related Threats
No named actor attribution yet. ATT&CK technique mapping in progress for this CVE.
Affected Assets
Mitigating Controls
Likely Mitigating Controls AI
Per-CVE control mapping for this CVE has not run yet; the list below is derived from the weakness types (CWEs) cited in the NVD entry.