SQL Injection Vulnerability in Online Fire Reporting System by PHPGurukul
CVE-2025-40687

9.3CRITICAL

Key Information:

Vendor

PHPgurukul
Status
Online Fire Reporting System
Vendor
CVE Published:
11 September 2025

What is CVE-2025-40687?

The Online Fire Reporting System version 1.2 by PHPGurukul is susceptible to SQL Injection due to improper handling of user-supplied data through the 'mobilenumber', 'teamleadname', and 'teammember' parameters. This exploitation can allow attackers to manipulate database queries, enabling them to retrieve, create, update, and delete database records through the vulnerable endpoint '/ofrs/admin/add-team.php'. It is crucial for users to apply the necessary security measures to safeguard their applications from potential breaches.

Affected Version(s)

Online Fire Reporting System 1.2

References

https://www.incibe.es/en/incibe-cert/notices/aviso/multip...

CVSS V4

Score:
9.3
Severity:
CRITICAL
Confidentiality:
High
Integrity:
High
Availability:
High
Attack Vector:
Network
Attack Complexity:
Low
Attack Required:
None
Privileges Required:
Undefined
User Interaction:
None

Timeline

  • Vulnerability published

  • Vulnerability Reserved

Credit

Rafael Pedrero
.
CVE-2025-40687 : SQL Injection Vulnerability in Online Fire Reporting System by PHPGurukul