CVE-2018-25420
HighCVSS 8.2Exploitation Probability (EPSS)
Low risk19th percentile - higher than 19% of all known CVEs
Summary
AiOPMSD Final 1.0.0 contains an SQL injection vulnerability that allows unauthenticated attackers to execute arbitrary SQL queries by injecting malicious code through the 'id' parameter. Attackers can send GET requests to watch.php with crafted SQL payloads to extract sensitive database information including usernames, database names, and version details.
Risk Assessment
An attacker can obtain user credentials and database configuration details, potentially leading to account takeover and further attacks.
Recommendation
Immediately upgrade AiOPMSD to the latest version or apply a fix that prevents SQL injection, such as using prepared statements.
Other vulnerabilities in AiOPMSD
See all- CVE-2018-25419High
AiOPMSD Final 1.0.0 contains an SQL injection vulnerability that allows unauthenticated attackers to execute arbitrary SQL queries by injecting malicious code through the genre parameter. Attackers can send GET requests to genre.php with crafted SQL payloads to extract sensitive database information including usernames, database names, and version details.
- CVE-2018-25418High
An SQL injection vulnerability exists in AiOPMSD Final 1.0.0 in year.php. An unauthenticated attacker can send a GET request with a crafted year parameter to execute arbitrary SQL queries and extract sensitive database information such as usernames, database names, and versions.
- CVE-2018-25417High
AiOPMSD Final 1.0.0 contains an SQL injection vulnerability that allows unauthenticated attackers to execute arbitrary SQL queries by injecting malicious code through the quality parameter. Attackers can send GET requests to quality.php with crafted SQL payloads to extract sensitive database information including usernames, database names, and version details.
- CVE-2018-25416High
AiOPMSD Final 1.0.0 contains an SQL injection vulnerability in the country parameter. Unauthenticated attackers can send crafted GET requests to country.php to execute arbitrary SQL queries and extract sensitive data such as usernames, database names, and versions.
- CVE-2018-25415High
AiOPMSD Final 1.0.0 contains an SQL injection vulnerability in the director parameter. Unauthenticated attackers can send crafted GET requests to director.php to execute arbitrary SQL queries and extract sensitive data such as usernames, database names, and versions.
- CVE-2018-25414High
AiOPMSD Final 1.0.0 contains an SQL injection vulnerability in the actor parameter. Unauthenticated attackers can send crafted GET requests to actor.php to execute arbitrary SQL queries and extract sensitive data such as usernames, database names, and versions.
- CVE-2018-25413High
An SQL injection vulnerability exists in AiOPMSD Final 1.0.0 in search.php. An unauthenticated attacker can send a GET request with a crafted 'q' parameter to execute arbitrary SQL queries and extract sensitive database information such as usernames, database names, and versions.
Original NVD description (English source)
AiOPMSD Final 1.0.0 contains an SQL injection vulnerability that allows unauthenticated attackers to execute arbitrary SQL queries by injecting malicious code through the 'id' parameter. Attackers can send GET requests to watch.php with crafted SQL payloads to extract sensitive database information including usernames, database names, and version details.