# CVE-2018-25418: AiOPMSD SQL injection in multiple PHP components

Source: https://junglewise.ai/threats/cve-2018-25418-aiopmsd-sql-injection-in-multiple-php-components  
Publisher: Junglewise Threat Intelligence, https://junglewise.ai/threats  
Published: 2026-05-30. Updated: 2026-05-30  
License: CC BY 4.0 with a link back

CVE-2018-25418 · Severity: high · CVSS 8.2 · Published 2026-05-30

AiOPMSD is a PHP-based content management system used for hosting movie streaming and download websites. A security flaw allows unauthenticated attackers to gain unauthorized access to the underlying database. This could lead to the exposure of sensitive information, including user credentials and system configuration details, potentially compromising the entire website and its users.

Technologies: [Hayinfx All in one pack Online Movie Streaming](https://junglewise.ai/threats/technologies/all-in-one-pack-online-movie-streaming). Vendors: [Hayinfx](https://junglewise.ai/threats/vendors/hayinfx).

## Quick answers

**Is CVE-2018-25418 exploited in the wild?** No. Junglewise Threat Intelligence has no report of CVE-2018-25418 being exploited in the wild.

**How severe is CVE-2018-25418?** High severity, with a CVSS score of 8.2, published 30 May 2026.

**Which products and versions are affected?** Hayinfx All in one pack Online Movie Streaming 1.0.0 Final.

**Is there a fix for CVE-2018-25418?** No fixed version is recorded yet. Check the vendor's advisory in the references below. If you run it, Junglewise drafts a mitigation that fits your setup and applies it once you approve, with senior security engineers behind it.

**How is CVE-2018-25418 attacked?** It is attacked over the network, in a web application.

**Am I affected by CVE-2018-25418?** Check whether you run Hayinfx All in one pack Online Movie Streaming at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

## Technical details

An SQL injection vulnerability exists in AiOPMSD Final 1.0.0 due to improper neutralization of special elements in SQL commands (CWE-89). The vulnerability is accessible via unauthenticated GET requests to several PHP endpoints, including year.php (year parameter), search.php (q parameter), actor.php (actor parameter), and others. By sending crafted SQL payloads, a remote attacker can bypass authentication to extract sensitive information from the MySQL database, such as database names, version details, and user credentials. The root cause is the direct inclusion of user-supplied input into SQL queries without adequate sanitization or the use of prepared statements. No official patch is known to be available as this is a legacy project.

## Affected products

- hayinfx All in one pack Online Movie Streaming (AiOPMSD) 1.0.0 Final

## Timeline

- 2017-09-05: other: Last project update (Final version build 4)
- 2018-10-24: disclosed: Exploit details published on Exploit-DB
- 2026-05-30: advisory: CVE-2018-25418 published/updated in NVD

## References

- [https://aiopmsd.sourceforge.io/](https://aiopmsd.sourceforge.io/)
- [https://sourceforge.net/projects/aiopmsd/files/latest/download](https://sourceforge.net/projects/aiopmsd/files/latest/download)
- [https://www.exploit-db.com/exploits/45690](https://www.exploit-db.com/exploits/45690)
- [https://www.vulncheck.com/advisories/aiopmsd-final-sql-injection-via-year-php](https://www.vulncheck.com/advisories/aiopmsd-final-sql-injection-via-year-php)

## Related threats

- [hayinfx AiOPMSD SQL injection in multiple components](https://junglewise.ai/threats/cve-2018-25419-hayinfx-aiopmsd-sql-injection-in-multiple-components)
- [AiOPMSD SQL injection in quality.php](https://junglewise.ai/threats/cve-2018-25417-aiopmsd-sql-injection-in-quality-php)
- [AiOPMSD SQL injection in multiple PHP components](https://junglewise.ai/threats/cve-2018-25415-aiopmsd-sql-injection-in-multiple-php-components)
- [AiOPMSD SQL injection in multiple PHP components](https://junglewise.ai/threats/cve-2018-25414-aiopmsd-sql-injection-in-multiple-php-components)
- [hayinfx AiOPMSD SQL injection in search.php](https://junglewise.ai/threats/cve-2018-25413-hayinfx-aiopmsd-sql-injection-in-search-php)