CVE-2024-58309 xbtitFM 4.1.18 Unauthenticated SQL Injection in shoutedit.php
Remote attackers can exploit an unauthenticated SQL injection in xbtitFM to extract database names, user credentials, and password hashes.
- Exploited in the wild
- Not known
- Login needed
- Any signed-in user
- Attackable
- Over the internet
- Victim action needed
- Not needed
- Fix
- None listed
What is CVE-2024-58309?
CVE-2024-58309 is a high-severity SQL injection vulnerability in xbtitFM, published on 11 Dec 2025. Any signed-in user can exploit it over the network, with no action from the victim.
Official description
xbtitFM 4.1.18 contains an unauthenticated SQL injection vulnerability that allows remote attackers to manipulate database queries by injecting malicious SQL code through the msgid parameter. Attackers can send crafted requests to /shoutedit.php with EXTRACTVALUE functions to extract database names, user credentials, and password hashes from the underlying database.
Weakness: CWE-89
Which versions are affected by CVE-2024-58309?
It affects 1 product.
Products include Xbtitfm Xbtitfm.
How do I fix CVE-2024-58309?
No fix has been published for CVE-2024-58309 yet. Limit exposure of the affected software until one is available.
Use parameterised queries everywhere and never build SQL by joining strings. Upgrade affected software first; a web application firewall only buys time. More about SQL injection.
Is CVE-2024-58309 being exploited?
It is not confirmed as exploited in the wild, but public exploit code for CVE-2024-58309 exists.
Other vulnerabilities in xbtitFM
Sources
Also known as GHSA-36pw-gpfg-hfxr.