CVE-2018-25418
HighCVSS 8.2Exploitation Probability (EPSS)
Low risk20th percentile - higher than 20% of all known CVEs
Summary
An SQL injection vulnerability exists in AiOPMSD Final 1.0.0 in year.php. An unauthenticated attacker can send a GET request with a crafted year parameter to execute arbitrary SQL queries and extract sensitive database information such as usernames, database names, and versions.
Risk Assessment
Attackers can steal sensitive database information, including credentials, potentially leading to full system compromise.
Recommendation
Immediately update the system or apply a patch to prevent SQL injection. Implement input filtering for the year parameter.
Other vulnerabilities in AiOPMSD
See all- CVE-2018-25420High
AiOPMSD Final 1.0.0 contains an SQL injection vulnerability that allows unauthenticated attackers to execute arbitrary SQL queries by injecting malicious code through the 'id' parameter. Attackers can send GET requests to watch.php with crafted SQL payloads to extract sensitive database information including usernames, database names, and version details.
- CVE-2018-25419High
AiOPMSD Final 1.0.0 contains an SQL injection vulnerability that allows unauthenticated attackers to execute arbitrary SQL queries by injecting malicious code through the genre parameter. Attackers can send GET requests to genre.php with crafted SQL payloads to extract sensitive database information including usernames, database names, and version details.
- CVE-2018-25417High
AiOPMSD Final 1.0.0 contains an SQL injection vulnerability that allows unauthenticated attackers to execute arbitrary SQL queries by injecting malicious code through the quality parameter. Attackers can send GET requests to quality.php with crafted SQL payloads to extract sensitive database information including usernames, database names, and version details.
- CVE-2018-25416High
AiOPMSD Final 1.0.0 contains an SQL injection vulnerability in the country parameter. Unauthenticated attackers can send crafted GET requests to country.php to execute arbitrary SQL queries and extract sensitive data such as usernames, database names, and versions.
- CVE-2018-25415High
AiOPMSD Final 1.0.0 contains an SQL injection vulnerability in the director parameter. Unauthenticated attackers can send crafted GET requests to director.php to execute arbitrary SQL queries and extract sensitive data such as usernames, database names, and versions.
- CVE-2018-25414High
AiOPMSD Final 1.0.0 contains an SQL injection vulnerability in the actor parameter. Unauthenticated attackers can send crafted GET requests to actor.php to execute arbitrary SQL queries and extract sensitive data such as usernames, database names, and versions.
- CVE-2018-25413High
An SQL injection vulnerability exists in AiOPMSD Final 1.0.0 in search.php. An unauthenticated attacker can send a GET request with a crafted 'q' parameter to execute arbitrary SQL queries and extract sensitive database information such as usernames, database names, and versions.
Original NVD description (English source)
AiOPMSD Final 1.0.0 contains an SQL injection vulnerability that allows unauthenticated attackers to execute arbitrary SQL queries by injecting malicious code through the year parameter. Attackers can send GET requests to year.php with crafted SQL payloads in the year parameter to extract sensitive database information including usernames, database names, and version details.