AiOPMSD Final 1.0.0 contains a classic SQL injection flaw that permits attackers to inject arbitrary SQL through the 'id' GET parameter on watch.php without needing authentication. The vulnerability can be abused to query internal tables and retrieve sensitive information such as usernames, database names, and version details, effectively allowing data exfiltration and potentially aiding further attacks. This weakness tests the CWE-89 category of injection flaws.

This issue affects the AiOPMSD Final application, version 1.0.0, as distributed from the official project site.

The CVSS score of 8.8 indicates high severity, and while the EPSS value is not published, the lack of a known exploitation restriction and the vulnerability’s absence from the KEV catalog suggest it remains a realistic threat. Attackers can pose as unwarranted users by sending crafted GET requests to watch.php. The flaw does not require special privileges or network access beyond visibility to the web interface, making it a practical vector for unauthenticated data compromise.