CVE-2025-40687: SQL injection in PHPGurukul Online Fire Reporting System
SQL Injection in Online Fire Reporting System v1.2 by PHPGurukul. This vulnerability allows an attacker to retrieve, create, update and delete database via
'mobilenumber', 'teamleadname' and 'teammember' parameters in the endpoint '/ofrs/admin/add-team.php'.
Affected Software
Event History
Frequently Asked Questions
What is the severity of CVE-2025-40687?
CVE-2025-40687 is classified as a critical SQL Injection vulnerability that can lead to unauthorized database access.
How do I fix CVE-2025-40687?
To fix CVE-2025-40687, sanitize and validate input parameters for 'mobilenumber', 'teamleadname', and 'teammember' before processing them in the query.
What systems are affected by CVE-2025-40687?
CVE-2025-40687 affects the Online Fire Reporting System v1.2 developed by PHPGurukul.
What can an attacker do with CVE-2025-40687?
An attacker exploiting CVE-2025-40687 can retrieve, create, update, and delete entries in the database through the vulnerable endpoint.
Is there any patch available for CVE-2025-40687?
As of now, there is no official patch released for CVE-2025-40687; users are advised to implement input validation as a mitigation measure.