AiOPMSD SQL Injection Vulnerability in Director Parameter

A SQL injection vulnerability has been identified in AiOPMSD Final version 1.0.0. This vulnerability allows unauthenticated attackers to execute arbitrary SQL queries by injecting malicious payloads through the 'director' parameter. Exploitation involves sending crafted GET requests to 'director.php', which can lead to the extraction of sensitive database information such as usernames, database names, and version details.

Impact

Exploitation of this vulnerability allows for arbitrary SQL execution, which could be used to manipulate the database or extract sensitive information.

Reproduction

The vulnerability can be reproduced by sending a GET request to 'director.php' with a crafted SQL payload in the 'director' parameter. The injected SQL is executed by the application, allowing the attacker to access sensitive database information.