AiOPMSD SQL Injection Vulnerability in genre.php

A SQL injection vulnerability has been identified in AiOPMSD Final version 1.0.0. This vulnerability allows unauthenticated attackers to execute arbitrary SQL queries by injecting malicious payloads through the genre parameter. Exploitation involves sending crafted GET requests to genre.php, which can lead to the extraction of sensitive database information such as usernames, database names, and version details.

Impact

Exploitation of this vulnerability allows for arbitrary SQL execution, which could be used to manipulate the database or extract sensitive information.

Reproduction

The vulnerability can be reproduced by sending a GET request to genre.php with a crafted SQL payload in the genre parameter. This can be done using a web browser or a tool like curl or Postman. The SQL injection can be verified by injecting SQL commands that, for example, concatenate database information with user-defined strings, which would then be returned in the response.