SQL Injection Vulnerability in Online Fire Reporting System by PHPGurukul
CVE-2025-40689

9.3CRITICAL

Key Information:

Vendor

PHPgurukul
Status
Online Fire Reporting System
Vendor
CVE Published:
11 September 2025

What is CVE-2025-40689?

The Online Fire Reporting System version 1.2 by PHPGurukul is susceptible to an SQL Injection vulnerability. This flaw can be exploited by attackers to manipulate database operations via the 'remark', 'status', and 'requestid' parameters in the endpoint '/ofrs/admin/request-details.php'. Successful exploitation can lead to unauthorized access, allowing attackers to read, create, modify, and delete database entries, posing a significant risk to the integrity and confidentiality of the data managed by this system.

Affected Version(s)

Online Fire Reporting System 1.2

References

https://www.incibe.es/en/incibe-cert/notices/aviso/multip...

CVSS V4

Score:
9.3
Severity:
CRITICAL
Confidentiality:
High
Integrity:
High
Availability:
High
Attack Vector:
Network
Attack Complexity:
Low
Attack Required:
None
Privileges Required:
Undefined
User Interaction:
None

Timeline

  • Vulnerability published

  • Vulnerability Reserved

Credit

Rafael Pedrero
.
CVE-2025-40689 : SQL Injection Vulnerability in Online Fire Reporting System by PHPGurukul