Vulnerability · Published Dec 11, 2025 · Assigned by VulnCheck
CVE-2024-58309xbtitFM 4.1.18 Unauthenticated SQL Injection in shoutedit.php
High 8.7
In plain English
A high-severity SQL injection in xbtitFM from xbtitfm. Proof-of-concept exploit code is public. The chance it is exploited in the next 30 days is estimated at 0.6% (higher than 48% of all known vulnerabilities).
Severity (CVSS 4.0)8.7High
Exploit odds (30 days)0.6%top 52.2% of all CVEs
Exploited in the wildNo reportsCISA SSVC: poc
Attack toolingNoneno public tooling known
Official description
xbtitFM 4.1.18 contains an unauthenticated SQL injection vulnerability that allows remote attackers to manipulate database queries by injecting malicious SQL code through the msgid parameter. Attackers can send crafted requests to /shoutedit.php with EXTRACTVALUE functions to extract database names, user credentials, and password hashes from the underlying database.
Affected products (as reported)
Weakness: CWE-89 · Vector: CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N
References
- ExploitDB-51909 exploit
- Official Vendor Homepage product
- VulnCheck Advisory: xbtitFM 4.1.18 Unauthenticated SQL Injection in shoutedit.php third-party-advisory