Critical severity9.8NVD Advisory· Published Dec 11, 2025· Updated Jun 17, 2026

CVE-2024-58309

Description

xbtitFM 4.1.18 contains an unauthenticated SQL injection vulnerability that allows remote attackers to manipulate database queries by injecting malicious SQL code through the msgid parameter. Attackers can send crafted requests to /shoutedit.php with EXTRACTVALUE functions to extract database names, user credentials, and password hashes from the underlying database.

AI Insight

LLM-synthesized narrative grounded in this CVE's description and references.

Affected products

xbtitFM/xbtitFM3 versions
cpe:2.3:a:xbtitfm:xbtitfm:4.1.18:*:*:*:*:*:*:*+ 2 more
- cpe:2.3:a:xbtitfm:xbtitfm:4.1.18:*:*:*:*:*:*:*
- (no CPE)range: <4.1.18
- (no CPE)range: 4.1.18

Patches

Vulnerability mechanics

References

www.exploit-db.com/exploits/51909nvdExploitThird Party AdvisoryVDB Entry
www.vulncheck.com/advisories/xbtitfm-unauthenticated-sql-injection-in-shouteditphpnvdThird Party Advisory
xbtitfm.eunvdProduct

News mentions

No linked articles in our index yet.

cvss	0.637
epss	0.000
exploit	0.000
kev	0.000
patch	0.000
ransomware	0.000