Executive brief
AiOPMSD is a PHP-based script used to create and manage online movie streaming and download websites. A security flaw in the software allows unauthorized individuals to access the underlying database without a password. This could lead to the theft of sensitive information, including user credentials and database configuration details, potentially compromising the entire website and its users.
Technical details
An SQL injection vulnerability exists in AiOPMSD Final 1.0.0 due to improper neutralization of special elements in several PHP components. Unauthenticated attackers can exploit this by sending crafted GET requests containing malicious SQL payloads to parameters such as 'id' in watch.php, 'q' in search.php, and others including actor.php, director.php, and genre.php. Successful exploitation allows for the extraction of sensitive data from the MySQL database, including database names, versions, and user information. The vulnerability is caused by a lack of input sanitization before passing user-supplied data into SQL queries. No official patch is currently documented for this legacy software.
Affected products
- hayinfx AiOPMSD (All in One pack Online Movie Streaming Download) 1.0.0 Final
Timeline
- 2017-09-05: other: Last software update (Final version build 4) released
- 2018-10-24: disclosed: Exploit code published on Exploit-DB
- 2026-05-30: advisory: CVE-2018-25420 published in NVD