Is CVE-2018-25417 exploited in the wild?

No. Junglewise Threat Intelligence has no report of CVE-2018-25417 being exploited in the wild.

How severe is CVE-2018-25417?

High severity, with a CVSS score of 8.2, published 30 May 2026.

Which products and versions are affected?

Hayinfx All in one pack Online Movie Streaming 1.0.0 Final.

Is there a fix for CVE-2018-25417?

No fixed version is recorded yet. Check the vendor's advisory in the references below. If you run it, Junglewise drafts a mitigation that fits your setup and applies it once you approve, with senior security engineers behind it.

How is CVE-2018-25417 attacked?

It is attacked over the network, in a web application.

Am I affected by CVE-2018-25417?

Check whether you run Hayinfx All in one pack Online Movie Streaming at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

CVE-2018-25417: AiOPMSD SQL injection in quality.php

CVE-2018-25417 · Severity: high · CVSS 8.2 · Published 2026-05-30

AiOPMSD is a PHP-based content management system used for building movie streaming and download websites. A security flaw allows unauthenticated attackers to gain unauthorized access to the underlying database. This could lead to the exposure of sensitive information, including user credentials, database structures, and server configuration details.

Technologies: Hayinfx All in one pack Online Movie Streaming. Vendors: Hayinfx.

Quick answers

Is CVE-2018-25417 exploited in the wild?: No. Junglewise Threat Intelligence has no report of CVE-2018-25417 being exploited in the wild.
How severe is CVE-2018-25417?: High severity, with a CVSS score of 8.2, published 30 May 2026.
Which products and versions are affected?: Hayinfx All in one pack Online Movie Streaming 1.0.0 Final.
Is there a fix for CVE-2018-25417?: No fixed version is recorded yet. Check the vendor's advisory in the references below. If you run it, Junglewise drafts a mitigation that fits your setup and applies it once you approve, with senior security engineers behind it.
How is CVE-2018-25417 attacked?: It is attacked over the network, in a web application.
Am I affected by CVE-2018-25417?: Check whether you run Hayinfx All in one pack Online Movie Streaming at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

Technical details

An SQL injection vulnerability exists in AiOPMSD Final 1.0.0 due to improper neutralization of special elements in SQL commands (CWE-89). The vulnerability is reachable via unauthenticated GET requests to several PHP endpoints, most notably quality.php using the 'quality' parameter, though other endpoints like search.php, actor.php, and watch.php are also affected. By sending crafted SQL payloads, a remote attacker can bypass authentication and execute arbitrary queries to extract sensitive data such as database names, versions, and user information. No patch is currently documented for this legacy software.

Affected products

hayinfx All in one pack Online Movie Streaming (AiOPMSD) 1.0.0 Final

Timeline

2017-09-05: other: Last software update (Final version build 4) released
2018-10-24: disclosed: Initial exploit code published on Exploit-DB
2026-05-30: advisory: CVE-2018-25417 published/updated in NVD dataset

References

This page as Markdown. Free to reuse under CC BY 4.0 with a link back.