CVE-2022-31983
Published: 02 June 2022
Summary
CVE-2022-31983 is a high-severity SQL Injection (CWE-89) vulnerability in Online Fire Reporting System Project Online Fire Reporting System. Its CVSS base score is 7.2 (High).
Operationally, ranked in the top 2.3% of CVEs by exploit likelihood; it is not currently listed in the CISA KEV catalog; a public proof-of-concept is referenced.
Deeper analysis
Online Fire Reporting System v1.0 contains a SQL injection vulnerability (CWE-89) at the endpoint /ofrs/admin/?page=requests/manage_request&id=. The flaw allows an authenticated administrator to supply crafted input that is concatenated directly into SQL queries without parameterization or escaping.
An attacker with administrative credentials can exploit the issue over the network to read, modify, or delete arbitrary database contents, and potentially escalate to full system compromise given the CVSS impact metrics of high confidentiality, integrity, and availability loss. The attack requires no user interaction and succeeds with low attack complexity once administrative access is obtained.
The associated EPSS score has remained near 0.45 with negligible movement between its recorded peak and current values, indicating sustained but not sharply increasing exploitation interest since disclosure. Public references consist of a detailed proof-of-concept posted to GitHub that reproduces the injection in the manage_request parameter.
EU & UK References
- 🇪🇺 ENISA EUVD: EUVD-2022-53263
Vulnerability details
Online Fire Reporting System v1.0 is vulnerable to SQL Injection via /ofrs/admin/?page=requests/manage_request&id=.
- CWE(s)
Related Threats
No named actor attribution yet. ATT&CK technique mapping in progress for this CVE.
Affected Assets
Mitigating Controls
Likely Mitigating Controls AI
Per-CVE control mapping for this CVE has not run yet; the list below is derived from the weakness types (CWEs) cited in the NVD entry.