AiOPMSD SQL Injection Vulnerability in search.php

A SQL injection vulnerability has been identified in AiOPMSD Final version 1.0.0. This vulnerability allows unauthenticated attackers to execute arbitrary SQL queries by injecting malicious payloads through the 'q' parameter. Exploitation involves sending crafted GET requests to search.php, which can lead to the extraction of sensitive database information such as usernames, database names, and version details.

Impact

Exploitation of this vulnerability allows for arbitrary SQL execution, which can be used to manipulate the database or extract sensitive information. In this case, the vulnerability was exploited to access database details and usernames.

Reproduction

The vulnerability can be reproduced by sending a GET request to search.php with a crafted SQL injection payload in the 'q' parameter. This can be done using a web browser or a tool like curl or Postman. The SQL payload should be designed to bypass any input validation and execute arbitrary SQL commands on the database.