The vulnerability lies in the quality.php script of AiOPMSD Final, where the quality GET parameter is not properly sanitized. This allows attackers to inject arbitrary SQL fragments, enabling execution of any SQL query. The flaw is a classic SQL injection, identified as CWE-89. Attackers can thus retrieve sensitive database information such as usernames, database names, and version details, resulting in potential data disclosure.

The affected product is AiOPMSD Final 1.0.0, developed by Aiopmsd. No later versions or patches are referenced in the current data, so installations of this specific release remain vulnerable.

The vulnerability carries a CVSS score of 8.8, indicating a high severity level. The EPSS score is not available, and the vulnerability is not listed in the CISA KEV catalog. Attackers can exploit the flaw remotely over HTTP using unauthenticated GET requests, requiring only knowledge of the vulnerable URL and standard SQL injection payloads. The low barrier to exploitation and the high potential for data exposure translate into a significant risk for affected systems.