CVE-2022-31978 – Online Fire Reporting System v1.0 contains a SQ... (How to Fix)

Q: What is the severity of CVE-2022-31978?

CVE-2022-31978 has a CVSS score of 9.8 (CRITICAL). Online Fire Reporting System v1.0 contains a SQL injection vulnerability in the delete_inquiry function that allows attackers to execute arbitrary SQL commands. This affects all users running the vulnerable version of the software, potentially compromising the entire database.

📋 TL;DR

Online Fire Reporting System v1.0 contains a SQL injection vulnerability in the delete_inquiry function that allows attackers to execute arbitrary SQL commands. This affects all users running the vulnerable version of the software, potentially compromising the entire database.

💻 Affected Systems

Products:

Online Fire Reporting System

Versions: v1.0

Operating Systems: Any

Default Config Vulnerable: ⚠️ Yes

Notes: Affects the web application regardless of underlying OS when using the vulnerable version.

📦 What is this software?

Online Fire Reporting System by Online Fire Reporting System Project

View all CVEs affecting Online Fire Reporting System →

⚠️ Risk & Real-World Impact

🔴

Worst Case

Complete database compromise including data theft, data destruction, and potential remote code execution via database functions.

🟠

Likely Case

Unauthorized data access, modification, or deletion of fire reporting records and user data.

🟢

If Mitigated

Limited impact with proper input validation and parameterized queries preventing SQL injection.

🌐 Internet-Facing: HIGH

🏢 Internal Only: MEDIUM

🎯 Exploit Status

Public PoC: ⚠️ Yes

Weaponized: LIKELY

Unauthenticated Exploit: ⚠️ Yes

Complexity: LOW

Public exploit details available in GitHub repository showing SQL injection via the delete_inquiry parameter.

🛠️ Fix & Mitigation

✅ Official Fix

Patch Version: Unknown

Vendor Advisory: None known

Restart Required: No

Instructions:

No official patch available. Implement parameterized queries in /ofrs/classes/Master.php and validate all user inputs.

🔧 Temporary Workarounds

Web Application Firewall

all

Deploy WAF with SQL injection rules to block malicious requests

Input Validation

all

Add server-side validation for all parameters in Master.php

🧯 If You Can't Patch

Isolate the system from internet access
Implement strict network segmentation and monitor all database queries

🔍 How to Verify

Check if Vulnerable:

Test /ofrs/classes/Master.php?f=delete_inquiry with SQL injection payloads like ' OR '1'='1

Check Version:

Check application version in admin panel or source code

Verify Fix Applied:

Verify parameterized queries are implemented and test with SQL injection payloads

📡 Detection & Monitoring

Log Indicators:

Unusual SQL queries in database logs
Multiple failed delete_inquiry attempts

Network Indicators:

HTTP requests to /ofrs/classes/Master.php with SQL keywords in parameters

SIEM Query:

source="web_logs" AND uri="/ofrs/classes/Master.php" AND (query CONTAINS "UNION" OR query CONTAINS "SELECT" OR query CONTAINS "DELETE")

📊 Metadata

CVE ID: CVE-2022-31978

CVSS v3 Score: 9.8 (CRITICAL)

CVSS Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

CWE: CWE-89

Published: June 2, 2022

Last Updated: November 21, 2024

🔗 References

https://github.com/k0xx11/bug_report/blob/main/vendors/oretnom23/online-fire-reporting-system/SQLi-5.md Exploit,Third Party Advisory
https://github.com/k0xx11/bug_report/blob/main/vendors/oretnom23/online-fire-reporting-system/SQLi-5.md Exploit,Third Party Advisory

📤 Share & Export

📄 Export Markdown 📋 Export JSON

🔗 Related Vulnerabilities

If you're affected by CVE-2022-31978, you might also want to check these: