A critical SQL injection vulnerability in XooDigital allows unauthenticated attackers to manipulate database queries, posing a severe risk of unauthorized data extraction.

This is an SQL injection vulnerability occurring in the results.php script. An unauthenticated attacker can exploit this by injecting malicious SQL code into the 'p' parameter via a GET request to extract information from the backend database.

Successful exploitation allows an attacker to bypass security controls and gain unauthorized access to sensitive data stored in the application database. Given the CVSS score of 8.2, this vulnerability is classified as High severity, as it facilitates data exfiltration and potential compromise of the confidentiality and integrity of the application environment.

Immediate Action: As there is no official patch available, administrators should immediately restrict access to the affected script or disable the XooDigital product until the vendor releases a security update.

Proactive Monitoring: Monitor web server logs for anomalous GET requests targeting results.php containing suspicious SQL syntax or encoded characters.

Compensating Controls: Implement a Web Application Firewall (WAF) with rules configured to detect and block SQL injection patterns, specifically targeting the 'p' parameter.

Public Exploit Available: Yes, a proof-of-concept exploit is available via ExploitDB (EDB-ID: 46610).

Due to the lack of an official patch and the public availability of exploit code, this vulnerability presents a significant risk to the organization. We strongly recommend removing the vulnerable software or isolating the affected server from the network until a secure version is provided by the vendor.