Online Fir System CVE-2026-5665

Real-world risk is elevated despite the absence of CISA KEV listing. The CVSS vector shows the worst-case attack conditions: network-accessible (AV:N), low attack complexity (AC:L), no privileges required (PR:N), and no user interaction needed (UI:N). The temporal metric E:P confirms proof-of-concept exploit code exists and is publicly accessible on GitHub. While CVSS 7.3 rates this as High severity with Limited impact across confidentiality, integrity, and availability (C:L/I:L/A:L), the authentication bypass potential significantly amplifies real-world risk. The vulnerability targets a login mechanism in what appears to be a niche open-source project (code-projects.org), suggesting limited vendor support and potentially slow or absent patching. Organizations running this system face immediate risk of unauthorized access and database compromise. The public exploit lowers the skill threshold for exploitation, making this accessible to low-sophistication threat actors. Remediation priority should be High for any internet-facing deployment.

An unauthenticated attacker identifies an internet-facing instance of Online FIR System 1.0 through automated scanning or search engine discovery. Using the publicly available GitHub proof-of-concept at https://github.com/ahmadmarz10-hub/CVEsMarz, the attacker crafts malicious SQL payloads in the email parameter of the /Login/checklogin.php endpoint. By injecting a payload such as admin' OR '1'='1'-- in the email field, the attacker bypasses authentication logic and gains administrative access to the FIR management system. Once authenticated, the attacker extracts sensitive law enforcement data including complainant information, case details, and potentially personal identifiable information stored in the database. The attacker could further manipulate or delete records to obstruct investigations, or establish persistent access for ongoing data theft. The low attack complexity and network accessibility make automated exploitation feasible at scale.