CVE-2022-31976

Online Fire Reporting System v1.0 is affected by a SQL Injection vulnerability in Master.php?f=delete_request. The issue arises from unsafely incorporating user input into SQL queries, enabling an attacker to execute arbitrary SQL commands and potentially cause data leakage, modification, or comp...

CVE-2022-31977

Online Fire Reporting System v1.0 is vulnerable to SQL Injection via /ofrs/classes/Master.php?f=deleteteam...

CVE-2022-31977

Online Fire Reporting System v1.0 is affected by a SQL Injection in Master.php?f=delete_team. The nuclei template confirms an SQLi path; CVE-2022-31977 has a reported CVSSv3.1 score of 9.8 and CWE-89. Impact describes arbitrary SQL execution, data leakage or manipulation, with high confidentialit...

CVE-2022-31978

Online Fire Reporting System v1.0 is affected by a SQL injection in /ofrs/classes/Master.php?f=delete_inquiry. The vulnerability stems from unsafely constructed SQL queries, allowing an attacker to execute arbitrary SQL and potentially cause data disclosure, modification, or unauthorized access. ...

CVE-2022-31978

Online Fire Reporting System v1.0 is vulnerable to SQL Injection via /ofrs/classes/Master.php?f=deleteinquiry...

CVE-2022-31980

Online Fire Reporting System v1.0 is vulnerable to SQL Injection via /ofrs/admin/?page=teams/manageteam&id=...

CVE-2022-31980

Online Fire Reporting System v1.0 is vulnerable to SQL Injection via /ofrs/admin/?page=teams/manage_team&id=. The root cause is unsanitized user input used in SQL queries, potentially enabling arbitrary SQL execution, data disclosure, or data manipulation. CVSS3.1 base score 7.2 (HIGH). Remediati...

CVE-2022-31981

Online Fire Reporting System v1.0 is affected by a SQL Injection vulnerability in the admin page parameter id (/ofrs/admin/?page=teams/view_team&id=). The Red Hat advisory also notes the same vector. Root cause identified as unsafe SQL construction leading to data exposure/manipulation; CVSS 3.1 ...

CVE-2022-31981

Online Fire Reporting System v1.0 is vulnerable to SQL Injection via /ofrs/admin/?page=teams/viewteam&id=...

CVE-2022-31982

Online Fire Reporting System v1.0 is vulnerable to SQL Injection via /ofrs/admin/?page=requests/viewrequest&id=...

CVE-2022-31982

Online Fire Reporting System v1.0 is affected by a SQL Injection vulnerability in the admin interface parameter id (path: /ofrs/admin/?page=requests/view_request&id=). The issue is caused by insufficient input validation/exploitation of untrusted input, enabling arbitrary SQL queries and partial/...

CVE-2022-31983

Online Fire Reporting System v1.0 is vulnerable to SQL Injection via /ofrs/admin/?page=requests/managerequest&id=...

CVE-2022-31983

CVE-2022-31983 affects Online Fire Reporting System v1.0. The vulnerability is a SQL Injection via the parameter /ofrs/admin/?page=requests/manage_request&id=. The root cause described across sources is lack of validation/sanitization of user input used in SQL queries. Impact stated in sources in...

CVE-2022-31984

The Online Fire Reporting System v1.0 is vulnerable to a SQL Injection flaw located at the /ofrs/admin/requests/take_action.php?id= endpoint. The root cause is a lack of validation of external input in the SQL statements, which allows an attacker to execute illegal SQL commands. Successful exploi...

PT-2022-21008

Name of the Vulnerable Software and Affected Versions Online Fire Reporting System version 1.0 Description The issue allows deletion of any file via the "/ofrs/classes/Master.php?f=delete img" API endpoint. Recommendations For Online Fire Reporting System version 1.0, restrict access to the...

PT-2022-21015

Name of the Vulnerable Software and Affected Versions Online Fire Reporting System version 1.0 Description The issue allows for SQL Injection via the "/ofrs/admin/?page=teams/view team&id=" API endpoint, specifically through the id variable. This could potentially lead to unauthorized access or...

CVE-2022-31982: Improper Neutralization of Special Elements used in an SQL Command

Online Fire Reporting System v1.0 is vulnerable to SQL Injection via /ofrs/admin/?page=requests/viewrequest&id=...

CVE-2022-31980: Improper Neutralization of Special Elements used in an SQL Command

Online Fire Reporting System v1.0 is vulnerable to SQL Injection via /ofrs/admin/?page=teams/manageteam&id=...

CVE-2022-31973: Undefined Security Weakness

Online Fire Reporting System v1.0 is vulnerable to Delete any file via /ofrs/classes/Master.php?f=deleteimg...

CVE-2022-31977: Improper Neutralization of Special Elements used in an SQL Command

Online Fire Reporting System v1.0 is vulnerable to SQL Injection via /ofrs/classes/Master.php?f=deleteteam...