XooDigital Latest contains an SQL injection vulnerability that allows unauthenticated attackers to manipulate database queries by injecting SQL code through the…

XooDigital Latest contains an SQL injection vulnerability identified as CVE-2019-25509 that allows unauthenticated attackers to manipulate database queries. The vulnerability exists in the 'p' parameter of the results.php file. Attackers can exploit this by sending crafted GET requests with malicious 'p' values to extract sensitive database information. This is a critical vulnerability as it requires no authentication and can lead to data extraction. The vulnerability has been documented with exploit code available on Exploit-DB.