CVE-2024-58309

CRITICAL

9.8

Beschreibung

xbtitFM 4.1.18 contains an unauthenticated SQL injection vulnerability that allows remote attackers to manipulate database queries by injecting malicious SQL code through the msgid parameter. Attackers can send crafted requests to /shoutedit.php with EXTRACTVALUE functions to extract database names, user credentials, and password hashes from the underlying database.

CVE Details

CVSS v3.1 Bewertung9.8

SchweregradCRITICAL

CVSS VektorCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

AngriffsvektorNETWORK

KomplexitatLOW

Erforderliche PrivilegienNONE

BenutzerinteraktionNONE

Veroffentlicht12/11/2025

Zuletzt geandert12/30/2025

Quellenvd

Honeypot-Sichtungen0

Betroffene Produkte

xbtitfm:xbtitfm

Schwachen (CWE)

CWE-89

Referenzen

https://www.exploit-db.com/exploits/51909(disclosure@vulncheck.com)

https://www.vulncheck.com/advisories/xbtitfm-unauthenticated-sql-injection-in-shouteditphp(disclosure@vulncheck.com)

https://xbtitfm.eu(disclosure@vulncheck.com)

IOC Korrelationen

Keine Korrelationen erfasst

This product uses data from the NVD API but is not endorsed or certified by the NVD.