CVE-2024-58309
CRITICALxbtitFM 4.1.18 - Unauthenticated SQL Injection via msgid Parameter
Title source: llmExploitation Summary
EIP tracks 1 public exploit for CVE-2024-58309. PoCs published by h5kj23kj32io2kj.
AI-analyzed exploit summary The exploit demonstrates unauthenticated SQL injection and path traversal vulnerabilities in xbtitFM 4.1.18, along with an authenticated insecure file upload leading to RCE. It includes functional payloads and detailed steps for exploitation.
Description
xbtitFM 4.1.18 contains an unauthenticated SQL injection vulnerability that allows remote attackers to manipulate database queries by injecting malicious SQL code through the msgid parameter. Attackers can send crafted requests to /shoutedit.php with EXTRACTVALUE functions to extract database names, user credentials, and password hashes from the underlying database.
Exploits (1)
The exploit demonstrates unauthenticated SQL injection and path traversal vulnerabilities in xbtitFM 4.1.18, along with an authenticated insecure file upload leading to RCE. It includes functional payloads and detailed steps for exploitation.
References (3)
Scores
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H