CVE-2022-31976
📋 TL;DR
Online Fire Reporting System v1.0 contains a SQL injection vulnerability in the delete_request function that allows attackers to execute arbitrary SQL commands. This affects all users running the vulnerable version of the software. Attackers can potentially access, modify, or delete database contents.
💻 Affected Systems
- Online Fire Reporting System
📦 What is this software?
Online Fire Reporting System by Online Fire Reporting System Project
⚠️ Risk & Real-World Impact
Worst Case
Complete database compromise leading to data theft, data destruction, or full system takeover via subsequent attacks.
Likely Case
Unauthorized data access, modification of fire reporting records, or denial of service by deleting critical data.
If Mitigated
Limited impact with proper input validation and database permissions restricting damage to non-critical data.
🎯 Exploit Status
Public proof-of-concept exists in GitHub repository. Simple SQL injection payloads can exploit this vulnerability.
🛠️ Fix & Mitigation
✅ Official Fix
Patch Version: Unknown
Vendor Advisory: No vendor advisory found
Restart Required: No
Instructions:
No official patch available. Consider implementing workarounds or migrating to alternative software.
🔧 Temporary Workarounds
Input Validation Filter
allAdd parameter validation to filter malicious SQL characters before processing
Modify /ofrs/classes/Master.php to sanitize all user inputs using prepared statements or parameterized queries
Web Application Firewall
allDeploy WAF with SQL injection rules to block exploitation attempts
Configure WAF to block requests containing SQL keywords to /ofrs/classes/Master.php?f=delete_request
🧯 If You Can't Patch
- Restrict network access to the application using firewall rules
- Implement database user with minimal privileges (read-only where possible)
🔍 How to Verify
Check if Vulnerable:
Test the endpoint with SQL injection payloads like: /ofrs/classes/Master.php?f=delete_request&id=1' OR '1'='1Check Version:
Check application version in web interface or configuration filesVerify Fix Applied:
Verify that SQL injection payloads no longer execute and return proper error handling📡 Detection & Monitoring
Log Indicators:
- Unusual SQL errors in application logs
- Multiple requests to delete_request endpoint with SQL keywords
Network Indicators:
- HTTP requests containing SQL injection patterns to vulnerable endpoint
SIEM Query:
source="web_logs" AND uri="/ofrs/classes/Master.php" AND (query="*delete_request*" AND (query="*' OR*" OR query="*UNION*" OR query="*SELECT*"))