PT-2025-50764 · Xbtitfm · Xbtitfm

Xbtitfm Team · Published 2025-12-11 · Updated 2025-12-12 · CVE-2024-58313

Positive Technologies (AI Summary)

CVSS v4.0

8.6

High

Base vector

AV:N/AC:L/AT:N/PR:H/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N

Name of the Vulnerable Software and Affected Versions xbtitFM version 4.1.18

Description The software contains an insecure file upload issue. Authenticated attackers with administrative privileges can upload and execute arbitrary PHP code through the file hosting feature. File type restrictions can be bypassed by modifying the Content-Type header to image/gif and adding GIF89a magic bytes, allowing the upload of web shells. These web shells can then execute system commands using alternate PHP tags. The vulnerable feature is the file hosting functionality. The attack involves manipulating the Content-Type header and utilizing alternate PHP tags.

Recommendations Apply a fix to restrict file uploads to authorized file types. Implement stricter validation of uploaded files, including checking file content and magic bytes. Disable or remove the file hosting feature if it is not essential.

Exploit

Fix

Unrestricted File Upload

Weakness Enumeration

CWE-434

Related Identifiers

CVE-2024-58313

Affected Products

Xbtitfm

References · 7

• 🔥 https://exploit-db.com/exploits/51909 · Exploit
• https://osv.dev/vulnerability/CVE-2024-58313 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2024-58313 · Security Note
• https://vulncheck.com/advisories/xbtitfm-insecure-file-upload-in-filehosting-feature · Note
• https://t.me/CVEtracker/39542 · Telegram Post
• https://twitter.com/VulmonFeeds/status/1999275942405914730 · Twitter Post
• https://xbtitfm.eu · Note