CVE-2018-25419: AiOPMSD Final SQL Injection Vulnerability

CVE-2018-25419 Overview

CVE-2018-25419 is a SQL injection vulnerability in AiOPMSD Final 1.0.0, an open-source media streaming application distributed via SourceForge. The flaw resides in genre.php, which passes the genre GET parameter directly into a backend SQL query without sanitization or parameterization. Unauthenticated remote attackers can append malicious SQL payloads to the parameter and extract database contents, including usernames, database names, and database version metadata. The weakness is classified as [CWE-89] Improper Neutralization of Special Elements used in an SQL Command.

Critical Impact
Unauthenticated attackers can extract sensitive database information by sending crafted GET requests to genre.php, exposing credentials and backend schema details over the network.

Affected Products

AiOPMSD Final 1.0.0
Distributions sourced from the AIOPMSD Project Homepage
Builds obtained via the AIOPMSD Latest Download

Discovery Timeline

2026-05-30 - CVE-2018-25419 published to NVD
2026-06-01 - Last updated in NVD database

Technical Details for CVE-2018-25419

Vulnerability Analysis

The vulnerability exists in the genre.php endpoint of AiOPMSD Final 1.0.0. The application accepts the genre parameter from an HTTP GET request and concatenates the value directly into a SQL statement executed against the backend database. Because the application performs no input validation, type coercion, or parameter binding, an attacker controls the structure of the resulting query.

Exploitation requires no authentication and no user interaction. An attacker sends a single HTTP GET request containing SQL syntax in the genre parameter. The injected query runs with the privileges of the database user configured for the application, allowing extraction of arbitrary data accessible to that account.

Detailed reproduction steps and payload examples are published in the Exploit-DB #45690 entry and the VulnCheck SQL Injection Advisory.

Root Cause

The root cause is direct string concatenation of untrusted user input into a SQL query within genre.php. The application does not use prepared statements, parameterized queries, or input allow-listing. Any character permitted by the URL parsing layer, including single quotes and UNION-based payloads, reaches the SQL interpreter intact.

Attack Vector

The attack vector is network-based and unauthenticated. An attacker issues a crafted GET request to the genre.php endpoint with SQL metacharacters appended to the genre parameter. Common exploitation techniques include UNION SELECT payloads to read user(), database(), and version(), followed by enumeration of information_schema tables to harvest application data.

The vulnerability mechanism is documented in the public PoC; no verified code examples are reproduced here. Refer to the Exploit-DB #45690 advisory for the full request structure.

Detection Methods for CVE-2018-25419

Indicators of Compromise

HTTP GET requests to /genre.php containing SQL keywords such as UNION, SELECT, information_schema, user(), database(), or version() in the genre parameter.
URL-encoded SQL metacharacters (%27, %20OR%20, %23) appearing in genre parameter values within web server access logs.
Database error messages or unusually large response bodies returned from genre.php requests.
Outbound traffic from the web server to attacker-controlled hosts following anomalous genre.php queries.

Detection Strategies

Deploy web application firewall signatures that flag SQL injection patterns targeting the genre parameter on genre.php.
Apply OCSF-normalized log analytics across web server access logs to identify repeated genre.php requests from a single source with varying payloads.
Correlate database audit logs showing information_schema access with corresponding HTTP requests to the AiOPMSD application.

Monitoring Recommendations

Enable verbose access logging on the web server hosting AiOPMSD and forward logs to a centralized SIEM for retention and query.
Monitor for HTTP 500 responses or sudden spikes in response size from genre.php, which can indicate successful injection or error-based exfiltration.
Alert on database accounts used by AiOPMSD executing queries against information_schema or system tables outside expected application behavior.

How to Mitigate CVE-2018-25419

Immediate Actions Required

Restrict network exposure of the AiOPMSD application to trusted networks or place it behind an authenticated reverse proxy.
Deploy WAF rules that block SQL metacharacters and UNION-based payloads in the genre parameter of genre.php.
Audit the database account used by AiOPMSD and reduce its privileges to the minimum required for application functionality.
Review web server and database logs for prior exploitation attempts referencing genre.php.

Patch Information

No official vendor patch is referenced in the NVD entry for CVE-2018-25419. AiOPMSD is distributed via SourceForge and the project page at AIOPMSD Project Homepage should be consulted for updated releases. Operators should consider replacing the application with an actively maintained alternative if no fix is available.

Workarounds

Modify genre.php locally to use parameterized queries or prepared statements when interacting with the database.
Apply server-side input validation that restricts the genre parameter to an allow-list of expected values.
Block direct internet access to genre.php at the network perimeter until a sanitized version is deployed.
Rotate database credentials and any application secrets that may have been exposed through prior injection attempts.

bash

# Example ModSecurity rule to block SQL injection patterns in the genre parameter
SecRule ARGS:genre "@rx (?i)(union(\s|/\*.*\*/)+select|information_schema|--|;|/\*|\*/|0x[0-9a-f]+)" \
    "id:1002518,phase:2,deny,status:403,log,msg:'CVE-2018-25419 AiOPMSD genre.php SQLi attempt'"