CVE-2018-25416

Vulnerability

AiOPMSD Final 1.0.0 (build 4, released September 2017) contains a SQL injection vulnerability in country.php. The application fails to sanitize user-supplied input in the country GET parameter before including it in SQL queries. This allows attackers to inject arbitrary SQL commands. No authentication is required to reach the vulnerable code path, and the condition is trivially exploitable by sending a crafted HTTP request to country.php?country=.... The affected version is AiOPMSD Final 1.0.0 (build 4) as described in the project's changelog [2]. Reference [1] provides the download link, and [3] confirms the vulnerability details.

Exploitation

An attacker can exploit this vulnerability from an unauthenticated network position. They send a GET request to country.php with a malicious SQL payload in the country parameter, for example: UNION SELECT .... The attacker does not require any prior access, user interaction, or special privileges. The request is processed immediately, and the attacker receives the database query results in the response. The process is straightforward and requires only a web browser or a simple scripting tool [1][3].

Impact

Successful exploitation allows the attacker to execute arbitrary SQL queries on the backend MySQL database. The attacker can extract sensitive data such as usernames, database names, table contents, and database version details. This constitutes a breach of confidentiality, potentially exposing user credentials, application data, and database schema. The attacker does not gain direct file system access or remote code execution, but the SQL injection provides significant ability to compromise the application's data integrity and confidentiality [1][3].

Mitigation

No official fix is available for CVE-2018-25416 as of the publication date (2026-05-30). The affected software (AiOPMSD Final 1.0.0) appears to be a final release with no subsequent patches released [2]. Users should consider upgrading to an alternative, actively maintained application. If upgrading is not possible, implement input validation and parameterized queries for all user-controlled parameters, and apply web application firewall (WAF) rules to block common SQL injection payloads. However, these workarounds may not fully mitigate the risk. The vulnerability is not listed on the CISA Known Exploited Vulnerabilities (KEV) catalog at the time of writing [1][2][3].