An unauthenticated SQL injection vulnerability in XooGallery allows remote attackers to compromise database integrity and potentially extract sensitive information.

This is a classic SQL injection (CWE-89) vulnerability occurring in the results.php script. An unauthenticated attacker can supply malicious input via the p GET parameter to manipulate backend database queries.

Successful exploitation allows an attacker to bypass authentication, extract sensitive application data, or modify existing database contents. Given the CVSS score of 8.2, this vulnerability represents a high risk to data confidentiality and integrity, potentially leading to significant operational disruption or regulatory non-compliance.

Immediate Action: As there is no official patch available from the vendor, users should immediately restrict access to the affected script or disable the XooGallery component until a secure version is released.

Proactive Monitoring: Security teams should monitor web server logs for suspicious GET requests to results.php containing SQL syntax characters, such as single quotes, OR/AND operators, or comment delimiters.

Compensating Controls: Deploy a Web Application Firewall (WAF) with rules configured to block SQL injection patterns specifically targeting the p parameter in the application URI path.

Public Exploit Available: Yes, a functional proof-of-concept exists via the ExploitDB entry 46609.

The presence of a publicly available exploit for this SQL injection vulnerability necessitates immediate defensive action. Organizations currently utilizing XooGallery should treat this as a high-priority risk and implement the recommended WAF filtering or access restrictions immediately to prevent unauthorized database access.