Executive brief
AiOPMSD is a PHP-based content management system used for building movie streaming and download websites. A security flaw allows unauthenticated attackers to gain unauthorized access to the underlying database. This could lead to the exposure of sensitive information, including user credentials, database structures, and server configuration details.
Technical details
An SQL injection vulnerability exists in AiOPMSD Final 1.0.0 due to improper neutralization of special elements in SQL commands (CWE-89). The vulnerability is reachable via unauthenticated GET requests to several PHP endpoints, most notably quality.php using the 'quality' parameter, though other endpoints like search.php, actor.php, and watch.php are also affected. By sending crafted SQL payloads, a remote attacker can bypass authentication and execute arbitrary queries to extract sensitive data such as database names, versions, and user information. No patch is currently documented for this legacy software.
Affected products
- hayinfx All in one pack Online Movie Streaming (AiOPMSD) 1.0.0 Final
Timeline
- 2017-09-05: other: Last software update (Final version build 4) released
- 2018-10-24: disclosed: Initial exploit code published on Exploit-DB
- 2026-05-30: advisory: CVE-2018-25417 published/updated in NVD dataset