CVE-2018-25420— AiOPMSD Final 1.0.0 SQL Injection via watch.php
Possible ATT&CK Techniques 2AI
T1005 · Data from Local System T1190 · Exploit Public-Facing ApplicationAffected Version Matrix 1
| Vendor | Product | Version Range | Status |
|---|---|---|---|
| Aiopmsd | AiOPMSD Final | 1.0.0 | affected |
Get alerts for future matching vulnerabilitiesLog in to subscribe
I. Basic Information for CVE-2018-25420
Vulnerability Information
Have questions about the vulnerability? See if Shenlong's analysis helps!
View Shenlong Deep Dive ↗ Although we use advanced large model technology, its output may still contain inaccurate or outdated information.Shenlong tries to ensure data accuracy, but please verify and judge based on the actual situation.
Vulnerability Title
AiOPMSD Final 1.0.0 SQL Injection via watch.php
Source: NVD (National Vulnerability Database)
Vulnerability Description
AiOPMSD Final 1.0.0 contains an SQL injection vulnerability that allows unauthenticated attackers to execute arbitrary SQL queries by injecting malicious code through the 'id' parameter. Attackers can send GET requests to watch.php with crafted SQL payloads to extract sensitive database information including usernames, database names, and version details.
Source: NVD (National Vulnerability Database)
CVSS Information
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:L/A:N
Source: NVD (National Vulnerability Database)
Vulnerability Type
SQL命令中使用的特殊元素转义处理不恰当(SQL注入)
Source: NVD (National Vulnerability Database)
Affected Products
| Vendor | Product | Affected Versions | CPE | Subscribe |
|---|---|---|---|---|
| Aiopmsd | AiOPMSD Final | 1.0.0 | - |
II. Public POCs for CVE-2018-25420
| # | POC Description | Source Link | Shenlong Link |
|---|
AI-Generated POCPremium
No public POC found.
Login to generate AI POCIII. Intelligence Information for CVE-2018-25420
请登录查看更多情报信息。
Other References for CVE-2018-25420 (4)
- https://www.vulncheck.com/advisories/aiopmsd-final-sql-injection-via-watch-phpthird-party-advisory
Same Patch Batch · Aiopmsd · 2026-05-30 · 8 CVEs total
| CVE-2018-25414 | 8.2 HIGH | AiOPMSD Final 1.0.0 SQL Injection via actor.php |
| CVE-2018-25418 | 8.2 HIGH | AiOPMSD Final 1.0.0 SQL Injection via year.php |
| CVE-2018-25419 | 8.2 HIGH | AiOPMSD Final 1.0.0 SQL Injection via genre.php |
| CVE-2018-25417 | 8.2 HIGH | AiOPMSD Final 1.0.0 SQL Injection via quality.php |
| CVE-2018-25415 | 8.2 HIGH | AiOPMSD Final 1.0.0 SQL Injection via director Parameter |
| CVE-2018-25416 | 8.2 HIGH | AiOPMSD Final 1.0.0 SQL Injection via country.php |
| CVE-2018-25413 | 8.2 HIGH | AiOPMSD Final 1.0.0 SQL Injection via search.php |
IV. Related Vulnerabilities
Same product: AiOPMSD Final
- CVE-2018-25419
AiOPMSD Final 1.0.0 SQL Injection via genre.php - CVE-2018-25418
AiOPMSD Final 1.0.0 SQL Injection via year.php - CVE-2018-25417
AiOPMSD Final 1.0.0 SQL Injection via quality.php - CVE-2018-25416
AiOPMSD Final 1.0.0 SQL Injection via country.php - CVE-2018-25415
AiOPMSD Final 1.0.0 SQL Injection via director Parameter
Same vendor: Aiopmsd
- CVE-2018-25419
AiOPMSD Final 1.0.0 SQL Injection via genre.php - CVE-2018-25418
AiOPMSD Final 1.0.0 SQL Injection via year.php - CVE-2018-25417
AiOPMSD Final 1.0.0 SQL Injection via quality.php - CVE-2018-25416
AiOPMSD Final 1.0.0 SQL Injection via country.php - CVE-2018-25415
AiOPMSD Final 1.0.0 SQL Injection via director Parameter
Same weakness: CWE-89
- CVE-2018-25425
Yot CMS 3.3.1 SQL Injection via aid and cid Parameters - CVE-2018-25424
Gate Pass Management System 2.1 SQL Injection via login-exec - CVE-2018-25422
MOGG web simulator Script All Version SQL Injection via play - CVE-2018-25419
AiOPMSD Final 1.0.0 SQL Injection via genre.php - CVE-2018-25418
AiOPMSD Final 1.0.0 SQL Injection via year.php
V. Comments for CVE-2018-25420
No comments yet