The vulnerability is an unfiltered SQL injection in the 'q' parameter of search.php that can be exploited by unauthenticated users via HTTP GET requests. Attackers can inject arbitrary SQL statements, allowing them to read sensitive data such as usernames, database names, and server version details. This weakness aligns with CWE‑89 and results in substantial confidentiality loss if the database contains private information.

The affected product is AiOPMSD Final version 1.0.0, released by Aiopmsd. No other product variations are listed.

The CVSS score of 8.8 indicates a high severity exploit. No EPSS data is available, so the exact exploitation probability is uncertain, and the vulnerability is not listed in the CISA KEV catalog. Because authentication is not required, the attack can originate from any network host that can reach the web server, making exposure widespread. Exploitation leverages the public search endpoint, so the vector is network-based.