SQL Injection in AiOPMSD Genre Parameter Allows Data Extraction

AiOPMSD Final 1.0.0 contains an SQL injection vulnerability that allows unauthenticated attackers to execute arbitrary SQL queries by injecting malicious code through the genre parameter. Attackers can send GET requests to genre.php with crafted SQL payloads in the genre parameter to extract sensitive database information including usernames, database names, and version details.

Casky was already ahead

This CVE exploits attack patterns that Casky's 301matched skills already investigate — long before this vulnerability was disclosed. Claude's reasoning model maps these techniques to MITRE ATT&CK, so practitioners who ran these skills have already seen the threat behaviour in their findings.

Analysis

AiOPMSD Final 1.0.0 contains a critical SQL injection vulnerability (CWE-89) in the genre.php endpoint that accepts unauthenticated requests. Attackers can craft malicious SQL payloads in the genre parameter to execute arbitrary database queries, exposing sensitive information including usernames, database names, and version details. This vulnerability matters because it requires no authentication, making it trivially exploitable by any network-connected attacker. Organizations running AiOPMSD are at immediate risk of data breach, credential compromise, and potential lateral movement if database credentials are extracted.

Casky's platform maps this vulnerability across 301 relevant security skills, enabling practitioners to detect both the exploitation technique (TA0043: Reconnaissance, specifically Active Scanning) and the underlying attack pattern (TA0001: Initial Access). Using Claude AI with extended reasoning, Casky helps security teams identify SQL injection attack signatures—such as suspicious SQL keywords (UNION, SELECT, OR 1=1) in HTTP parameters, unusual database query patterns, and error-based responses—before and after exploitation. Practitioners leveraging Casky would see findings highlighting parameter validation bypasses, unfiltered user input flowing directly to SQL queries, and reconnaissance activities probing database structure through error messages. This multi-skill approach enables teams to map detection coverage across their environment and remediate both the vulnerability and detection gaps simultaneously.

Live Threat IntelligenceComing soon

Casky Risk Score

—

EPSS Probability

—

Shodan Exposure

—

GreyNoise Signal

—

Composite risk scoring from EPSS, CISA KEV, Shodan, and GreyNoise — 21 security APIs correlated into a single Casky Risk Score. Coming in Casky Pro. Join early access →

301 Casky skills cover this attack pattern

These skills use Claude AI's reasoning model to surface findings in the same attack categories as CVE-2018-25419.

analyzing-apt-group-with-mitre-navigator

threat intelligence · low

Run

analyzing-campaign-attribution-evidence

threat intelligence · low

Run

analyzing-certificate-transparency-for-phishing

threat intelligence · low

Run

MITRE ATT&CK Techniques

TA0001 TA0043

Investigate the attack patterns behind CVE-2018-25419

Casky has 301 skills that investigate the attack patterns behind CVE-2018-25419. Run one and get CVSS-scored findings in 3 minutes.

Run the skill that detects this →

X Instagram LinkedIn