XooGallery SQL Injection Vulnerability

A SQL injection vulnerability has been identified in XooGallery Latest, allowing unauthenticated attackers to manipulate database queries by injecting SQL code through the 'p' parameter. This vulnerability is present in all versions of XooGallery Latest. Attackers can send GET requests to results.php with malicious 'p' values to bypass authentication, extract sensitive data, or modify database contents.

Impact

Exploitation of this vulnerability allows for SQL injection, where attackers can manipulate database queries to extract, modify, or delete database information. This could lead to unauthorized data access or modification.

Reproduction

To reproduce this vulnerability, send a GET request to results.php with a crafted 'p' parameter that includes SQL injection payloads. The injected SQL code can manipulate the database query, potentially bypassing authentication or accessing sensitive data.