PT-2025-37171 · Unknown · Online Fire Reporting System

Rafael Pedrero · Published 2025-09-11 · Updated 2025-09-16 · CVE-2025-40689

Positive Technologies (AI Summary)

CVSS v3.1

9.8

Critical

Base vector

AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

Name of the Vulnerable Software and Affected Versions: Online Fire Reporting System version 1.2

Description: The Online Fire Reporting System is susceptible to SQL Injection attacks. An attacker can potentially retrieve, create, update, and delete database information through the remark, status, and requestid parameters in the /ofrs/admin/request-details.php API endpoint.

Recommendations: Apply input validation and sanitization to the remark, status, and requestid parameters in the /ofrs/admin/request-details.php endpoint. Consider using parameterized queries or prepared statements to prevent SQL Injection.

Fix

SQL injection

Weakness Enumeration

CWE-89

Related Identifiers

CVE-2025-40689

Affected Products

Online Fire Reporting System

References · 6

• https://nvd.nist.gov/vuln/detail/CVE-2025-40689 · Security Note
• https://osv.dev/vulnerability/CVE-2025-40689 · Vendor Advisory
• https://t.me/cveNotify/135279 · Telegram Post
• https://twitter.com/VulmonFeeds/status/1966196206792540464 · Twitter Post
• https://incibe.es/en/incibe-cert/notices/aviso/multiple-vulnerabilities-phpgurukuls-online-fire-reporting-system · Note
• https://twitter.com/cracbot/status/1967906364178440550 · Twitter Post