cbcvebase.
CVE-2022-31984
published 2022-06-02

CVE-2022-31984: Online Fire Reporting System v1.0 is vulnerable to SQL Injection via /ofrs/admin/requests/take_action.php?id=.

PriorityP268high7.2CVSS 3.1
AVNACLPRHUINSUCHIHAH
ITWEXPLOITVulnCheck KEV
Exploited in the wild
EPSS
4.86%
90.9th percentile
Online Fire Reporting System v1.0 is vulnerable to SQL Injection via /ofrs/admin/requests/take_action.php?id=.

Affected

1 ranges
VendorProductVersion rangeFixed in
online_fire_reporting_system_projectonline_fire_reporting_system——

Detection & IOCsextracted from sources · hover to see the quote

url/ofrs/admin/requests/take_action.php?id=↗
path/admin/requests/take_action.php
command6'+UNION+ALL+SELECT+md5('999999999'),NULL,NULL,NULL,NULL,NULL,NULL,NULL,NULL,NULL--+-
  • →Detect SQL injection probe: GET request to /admin/requests/take_action.php with an id parameter containing a UNION-based payload (10-column SELECT with md5() canary value). A 200 response body containing the md5 of the injected integer confirms exploitation.
  • →Match HTTP 200 response body containing the md5 hash of the injected canary value (md5('999999999')) to confirm blind/UNION SQLi success.
  • →The vulnerable parameter is 'id' in the GET query string; the injection requires high privileges (PR:H per CVSS) — monitor authenticated admin-session requests to take_action.php for SQLi patterns.
  • ·Exploitation requires high privileges (authenticated admin session); unauthenticated attackers cannot directly reach the vulnerable endpoint.
  • ·The nuclei template targets the path /admin/requests/take_action.php (without the /ofrs/ prefix used in the NVD description); deployments may differ in base path — adjust detection rules accordingly.
  • ·The UNION SELECT payload assumes exactly 10 columns in the underlying query; schema changes in other versions would require a different column count.

CVSS provenance

nvdv3.17.2HIGHCVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H
nvdv2.06.5MEDIUMAV:N/AC:L/Au:S/C:P/I:P/A:P
vulncheck7.2HIGH
CVEs like this are exactly what “Exploited This Week” covers.

Every Monday: what got weaponized or added to CISA KEV in the last seven days — each CVE cross-linked to its PoC, Nuclei template, and detection rule. Free, one email a week, unsubscribe in one click.