AiOPMSD Final 1.0.0 contains a classic SQL injection flaw that does not require authentication; an attacker can embed malicious SQL code into the genre query string and cause the application to execute arbitrary SQL statements. This flaw corresponds to CWE‑89 and allows an attacker to read sensitive database information such as user names, database names, and the database version, thereby compromising confidentiality and potentially enabling further post‑exploitation steps.

AiOPMSD Final version 1.0.0 is affected. No other vendor or product variations are listed.

The flaw carries a CVSS score of 8.8, indicating high severity and broad impact. No embedded EPSS score is available, and the vulnerability is not listed in the CISA KEV catalog, so explicit exploitation likelihood is uncertain, yet an exploit exists in public exploit repositories. Attackers can trigger the vulnerability via unauthenticated HTTP GET requests to genre.php, so the attack surface is the public network and the risk is moderate to high for exposed installations.