Executive brief
AiOPMSD is a PHP-based content management system used to host and manage movie streaming websites. A security flaw allows unauthenticated attackers to access the underlying database without a password. This could lead to the theft of sensitive information, including user data, database structures, and server configuration details.
Technical details
An SQL injection vulnerability exists in AiOPMSD Final 1.0.0 due to improper neutralization of special elements in SQL commands (CWE-89). The vulnerability is accessible via unauthenticated GET requests to multiple PHP endpoints, including country.php, search.php, actor.php, and watch.php, using parameters such as 'country', 'q', 'actor', and 'id'. An attacker can exploit this by sending crafted SQL payloads to extract sensitive information from the MySQL database, such as the database name, version, and user credentials. No authentication or user interaction is required for exploitation. As of the advisory date, no official patch has been identified for this legacy software.
Affected products
- AiOPMSD All in one pack Online Movie Streaming (AiOPMSD) 1.0.0 Final
Timeline
- 2018-10-24: disclosed: Initial exploit discovery and PoC published by Ihsan Sencan
- 2026-05-30: advisory: CVE-2018-25416 published to NVD via VulnCheck