Exploitation Summary
EIP tracks 2 public exploits for CVE-2024-58290. PoCs published by Sohel Yousef, SohelYousef.
AI-analyzed exploit summary This exploit demonstrates SQL injection vulnerabilities in the xhibiter NFT marketplace, specifically targeting the 'id' parameter in the collections endpoint. It includes payloads for boolean-based blind, time-based blind, and UNION-based SQL injection techniques.
Description
Xhibiter NFT Marketplace 1.10.2 contains a SQL injection vulnerability in the collections endpoint that allows attackers to manipulate database queries through the 'id' parameter. Attackers can exploit boolean-based, time-based, and UNION-based SQL injection techniques to potentially extract or manipulate database information by sending crafted payloads to the collections page.
Exploits (2)
This exploit demonstrates SQL injection vulnerabilities in the xhibiter NFT marketplace, specifically targeting the 'id' parameter in the collections endpoint. It includes payloads for boolean-based blind, time-based blind, and UNION-based SQL injection techniques.
This repository contains a Python-based Proof of Concept (PoC) for CVE-2024-58290, an unauthenticated SQL Injection vulnerability in Xhibiter NFT Marketplace 1.10.2. The PoC uses a time-based blind SQLi payload to verify the vulnerability by inducing a 5-second delay in the database response.
References (3)
Scores
CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:N/SC:N/SI:N/SA:N