CVE-2024-58290

CRITICAL

Xhibiter NFT Marketplace 1.10.2 SQL Injection via Collections Endpoint

Title source: CVE List
Search associated code STIX 2.1 vulnerability STIX 2.1 with PoCs

Record summary

CVE-2024-58290 has a selected CVSS score of 9.3 (critical); EIP currently links 1 catalogued exploit and 1 repository PoC.

Description

Xhibiter NFT Marketplace 1.10.2 contains a SQL injection vulnerability in the collections endpoint that allows attackers to manipulate database queries through the 'id' parameter. Attackers can exploit boolean-based, time-based, and UNION-based SQL injection techniques to potentially extract or manipulate database information by sending crafted payloads to the collections page.

Description source: CVE List

Exploitation context

Available material

Catalogued exploits
1
Repository PoCs
1

CISA SSVC decision

ExploitationPoC
AutomatableYes
Technical impactTotal

CISA Coordinator · SSVC 2.0.3 · Evaluated Dec 18, 2025 · Source: CVE List

Affected products and versions

1
ProductSourceVersion range

Xhibiter NFT Marketplace

Browse Elements / Xhibiter NFT Marketplace

Default status: unaffected

CVE List1.10.2affected

Proofs of concept

2

Catalogued exploits

ExploitDBXhibiter NFT Marketplace 1.10.2 - SQL InjectionExploitDB exploitby Sohel YousefNot analyzed1 file
ExploitDB
PoC details

Repository PoCs

GitHubSohelYousef/CVE-2024-58290-Xhibiter-SQLiRepository PoCby SohelYousef0Scanner2 files

3.9 KiB

GitHub
PoC details
Analysisdeepseek-v4-pro:cloud ·

Technical assessment

A Python script that sends a time-based blind SQL injection payload to the /collections endpoint and measures response delay to detect vulnerability CVE-2024-58290. It does not extract data or manipulate the database.

Backdoor review

No backdoor observed in reviewed code

The repository contains a README and a Python PoC script for CVE-2024-58290. The script sends a time-based SQL injection payload to a user-supplied URL to test for the vulnerability. No backdoor, deceptive payload, persistence, credential theft, or unrelated remote access behavior is observed. The script's actions are limited to the stated vulnerability detection.

ClassificationScanner
Model confidence98%
AuthenticationNot required
LanguagesPython
Target softwareXhibiter NFT Marketplace
Attack typesSQL Injection
Evidence & reasoningClassification basis · observed behavior · safety review
Technical evidence

Classification basis and observed behavior

Classification basis

The script only detects the vulnerability by measuring response delay; it does not extract data, modify the database, or establish a shell. The README describes it as a detection script, and the code confirms it performs a time-based check and reports success/failure.

README.md:25poc.py:6poc.py:44-50

Requirements

  • Target running Xhibiter NFT Marketplace 1.10.2 with accessible /collections endpointREADME.md:16poc.py:22

Observed behavior

  • Sends HTTP GET request to /collections with id parameter containing SLEEP(5) payloadpoc.py:28-30poc.py:39
  • Measures response time and reports vulnerability if delay >= 5 seconds or request times outpoc.py:37-40poc.py:44-54
Safety-review evidence

Behaviors behind the backdoor verdict

Observables

Network Request
Payload withheldThe script sends an HTTP GET request to the user-provided URL with the SQL injection payload in the 'id' parameter. This is the core of the PoC and matches the described vulnerability.poc.py:39
Sql Injection Payload
Payload withheldThe payload is a standard time-based blind SQL injection test using SLEEP(5). It is used to detect the vulnerability and does not perform data exfiltration or system modification.poc.py:28
Review boundaries

What the analysis did not establish

  • Only the two text files (README.md, poc.py) were reviewed; no binary files were present or inspected.
  • The review does not verify the script's behavior at runtime or the safety of the requests library.
Model interpretation

This review is limited to the supplied PoC code and context. It does not assert that the code works or is safe to execute.

References

4