CVE-2024-58309 is a critical (CVSS 9.8) unauthenticated SQL injection in xbtitFM 4.1.18. The msgid parameter of the shoutedit.php page is passed into a database query without proper handling, which can expose database names, credentials and password hashes. The record names no fixed version, so confirm one with the project.
What's affected
The record lists xbtitFM version 4.1.18, a PHP application used to run BitTorrent tracker sites. The vulnerable file is /shoutedit.php, which handles edits to shoutbox messages, and the injectable input is the msgid request parameter.
No fixed version appears in the record or in the references. The sources are the VulnCheck advisory, a public exploit database entry and the project website. Because we could not confirm a patched release, the safe reading is that every 4.1.18 install is exposed until the maintainers say otherwise.
The impact in the record is disclosure of the names of databases, user credentials and password hashes. With a score of 9.8, the CVSS vector assumes no authentication and no user interaction.
How to check if you're exposed
Confirm whether you run xbtitFM and where.
- Search your servers for the xbtitFM application directory and the file
shoutedit.php. - Read the version from the application files or the admin page. Version 4.1.18 is the one named in the record.
- Search web server logs for requests to
shoutedit.php, especially with unusualmsgidvalues or very long query strings, and for repeated requests from one address. - Check database logs, if you keep them, for unusual queries touching the user tables.
If you find signs of probing, assume the user table was read, force password resets, and tell your users that their password hashes may have been exposed.
What to do now
- Locate every xbtitFM install and confirm the version.
- Block or remove access to shoutedit.php at the web server until a fix is confirmed.
- Ask the project for a patched build and watch its site for an update.
- Review logs for requests to the affected file and for abnormal database activity.
- Reset admin and user passwords if you see probing, and notify users if hashes may have leaked.
- Consider moving off unmaintained software if no fix arrives.
Why it matters
This is the same class of bug as the Quick.CMS login flaw, but it needs no login at all. A request parameter reaches a query without being treated as data, so a stranger can change what the database returns.
Page-level handlers like a shoutbox editor are easy to forget during hardening, because they feel minor. They run with the same database account as the rest of the site, so one weak handler can expose everything that account can read. Using prepared statements everywhere, and giving the web application a database account with only the access it needs, limits the damage when one handler is missed.
The weakness class is CWE-89: SQL Injection. The CVSS vector in the record is CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H, which scores 9.8. This CVE is not listed in the CISA Known Exploited Vulnerabilities catalog at the time of writing.
Quick check
Which parameter is affected?
The record names msgid in shoutedit.php. It does not give any fix, so restrict access to that file.
Are password hashes at risk?
The record says user credentials and password hashes can be extracted, so yes if the site is exposed and unpatched.
Sources
Last reviewed: 19 October 2026.
