CVE-2024-58309

HIGH

xbtitFM 4.1.18 Unauthenticated SQL Injection in shoutedit.php

Title source: CVE List
Search associated code STIX 2.1 vulnerability STIX 2.1 with PoCs

Record summary

CVE-2024-58309 has a selected CVSS score of 8.7 (high); EIP currently links 1 catalogued exploit.

Description

xbtitFM 4.1.18 contains an unauthenticated SQL injection vulnerability that allows remote attackers to manipulate database queries by injecting malicious SQL code through the msgid parameter. Attackers can send crafted requests to /shoutedit.php with EXTRACTVALUE functions to extract database names, user credentials, and password hashes from the underlying database.

Description source: CVE List

Exploitation context

Available material

Catalogued exploits
1

CISA SSVC decision

ExploitationPoC
AutomatableNo
Technical impactTotal

CISA Coordinator · SSVC 2.0.3 · Evaluated Dec 16, 2025 · Source: CVE List

Affected products and versions

1
ProductSourceVersion range

xbtitFM

Browse xbtitfm / xbtitFM

Default status: unaffected

CVE List4.1.18affected

Proofs of concept

1

Catalogued exploits

ExploitDBxbtitFM 4.1.18 - Multiple VulnerabilitiesExploitDB exploitby h5kj23kj32io2kjNot analyzed1 file

linked to 3 vulnerabilities

ExploitDB
PoC details

References

4