A web application in Xooscripts XooGallery is affected by multiple SQL injection points in photo.php. The flaw allows an attacker to control the SQL query executed against the database by supply a malicious photo_id value in a GET request. This can lead to sensitive data extraction, authentication bypass, or unauthorized modification of database contents. The weakness is classified as CWE-89, reflecting improper handling of external input in SQL statements.

The vulnerability resides in Xooscripts XooGallery, specifically in the current or latest releases that have not been patched. No explicit version range is provided, so any installation of XooGallery that includes the original photo.php code is potentially vulnerable unless a later fix has been applied.

The CVSS score of 8.8 indicates high severity, while the EPSS score of less than 1% suggests that exploitation is currently uncommon. The vulnerability is not listed in the CISA KEV catalog. Exploitation requires a remote attacker to craft a GET request to photo.php with a malicious photo_id value, which means the attack vector is likely the web application interface. Given the high impact potential and the need for authentication bypass, the risk to affected systems remains significant until mitigated.