VULNERABILITY INTELLIGENCE

CVE-2024-58309

CVSS score9.8 CRITICAL
EPSS probability0.58%
CISA KEVNot currently listed
Published2025-12-11
Last modified2026-10-27
CVSS vectorCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

Description

xbtitFM 4.1.18 contains an unauthenticated SQL injection vulnerability that allows remote attackers to manipulate database queries by injecting malicious SQL code through the msgid parameter. Attackers can send crafted requests to /shoutedit.php with EXTRACTVALUE functions to extract database names, user credentials, and password hashes from the underlying database.

Weakness classification

  • disclosure@vulncheck.com: CWE-89

Primary references