Executive brief
AiOPMSD is a PHP-based content management system used for hosting movie streaming and download websites. A security flaw allows unauthenticated attackers to gain unauthorized access to the underlying database. This could lead to the exposure of sensitive information, including user credentials and system configuration details, potentially compromising the entire website and its users.
Technical details
An SQL injection vulnerability exists in AiOPMSD Final 1.0.0 due to improper neutralization of special elements in SQL commands (CWE-89). The vulnerability is accessible via unauthenticated GET requests to several PHP endpoints, including year.php (year parameter), search.php (q parameter), actor.php (actor parameter), and others. By sending crafted SQL payloads, a remote attacker can bypass authentication to extract sensitive information from the MySQL database, such as database names, version details, and user credentials. The root cause is the direct inclusion of user-supplied input into SQL queries without adequate sanitization or the use of prepared statements. No official patch is known to be available as this is a legacy project.
Affected products
- hayinfx All in one pack Online Movie Streaming (AiOPMSD) 1.0.0 Final
Timeline
- 2017-09-05: other: Last project update (Final version build 4)
- 2018-10-24: disclosed: Exploit details published on Exploit-DB
- 2026-05-30: advisory: CVE-2018-25418 published/updated in NVD