PT-2025-50761 · Xbtitfm · Xbtitfm

Xbtitfm Team · Published 2025-12-11 · Updated 2025-12-12 · CVE-2024-58309

Positive Technologies (AI Summary)

CVSS v3.1

9.8

Critical

Base vector

AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

Name of the Vulnerable Software and Affected Versions xbtitFM version 4.1.18

Description The software contains an unauthenticated SQL injection issue. Remote attackers can manipulate database queries by injecting malicious SQL code through the msgid parameter. Crafted requests sent to the '/shoutedit.php' API endpoint, utilizing functions like EXTRACTVALUE, can allow attackers to extract database names, user credentials, and password hashes.

Recommendations Apply a fix to address SQL injection in the msgid parameter of the '/shoutedit.php' API endpoint.

Exploit

Fix

SQL injection

Weakness Enumeration

CWE-89

Related Identifiers

CVE-2024-58309

Affected Products

Xbtitfm

References · 7

• 🔥 https://exploit-db.com/exploits/51909 · Exploit
• https://osv.dev/vulnerability/CVE-2024-58309 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2024-58309 · Security Note
• https://t.me/CVEtracker/39539 · Telegram Post
• https://vulncheck.com/advisories/xbtitfm-unauthenticated-sql-injection-in-shouteditphp · Note
• https://xbtitfm.eu · Note
• https://twitter.com/VulmonFeeds/status/1999281062304776424 · Twitter Post