PT-2025-50744 · Unknown · Xhibiter Nft Marketplace

Sohel Yousef · Published 2025-12-11 · Updated 2026-01-21 · CVE-2024-58290

Positive Technologies (AI Summary)

CVSS v4.0

9.3

Critical

Base vector

AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:N/SC:N/SI:N/SA:N

Name of the Vulnerable Software and Affected Versions Xhibiter NFT Marketplace version 1.10.2

Description The Xhibiter NFT Marketplace software has a SQL injection issue in the collections endpoint. An attacker can manipulate database queries by using the id parameter. Boolean-based, time-based, and UNION-based SQL injection techniques can be used to extract or manipulate database information by sending crafted payloads to the collections page. The API endpoint affected is '/collections'. The vulnerable parameter is id.

Recommendations Apply a fix to sanitize the id parameter in the collections endpoint to prevent SQL injection. As a temporary workaround, restrict access to the collections endpoint to minimize the risk of exploitation.

Exploit

Fix

SQL injection

Weakness Enumeration

CWE-89

Related Identifiers

CVE-2024-58290

Affected Products

Xhibiter Nft Marketplace

References · 8

• 🔥 https://exploit-db.com/exploits/52060 · Exploit
• https://nvd.nist.gov/vuln/detail/CVE-2024-58290 · Security Note
• https://twitter.com/SohelYousefcve/status/2013339658386592139 · Twitter Post
• https://twitter.com/VulmonFeeds/status/1999324579865518535 · Twitter Post
• https://twitter.com/0dayPublishing/status/1999236621888090117 · Twitter Post
• https://twitter.com/SohelYousefcve/status/2014004246270591262 · Twitter Post
• https://vulncheck.com/advisories/xhibiter-nft-marketplace-sql-injection-via-collections-endpoint · Note
• https://elements.envato.com/xhibiter-nft-marketplace-html-template-AQN45FA · Note