CVE-2024-58309

xbtitFM 4.1.18 Unauthenticated SQL Injection in shoutedit.php

CVSS 8.7 HIGHEPSS 0.5%CWE-89

Vexday Risk Score

21Baixo

Decisão SSVC (CISA)

Track

Sem sinal de exploração → monitorar

CVSS 8.7EPSS 0.5%KEV nãoPoC —Nuclei —Metasploit —Patch —

Ciclo de vida

11 dez 2025Publicada no NVD

Recomendação: Monitorar — sem sinal de exploração no momento.

xbtitFM 4.1.18 contains an unauthenticated SQL injection vulnerability that allows remote attackers to manipulate database queries by injecting malicious SQL code through the msgid parameter. Attackers can send crafted requests to /shoutedit.php with EXTRACTVALUE functions to extract database names, user credentials, and password hashes from the underlying database.

CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N

Produtos afetados

xbtitfm · xbtitFM

Referências

https://www.exploit-db.com/exploits/51909 https://www.vulncheck.com/advisories/xbtitfm-unauthenticated-sql-injection-in-shouteditphp https://xbtitfm.eu