xbtitFM SQL Injection Vulnerability in shoutedit.php

A SQL injection vulnerability has been identified in xbtitFM version 4.1.18. This vulnerability allows remote attackers to execute malicious SQL queries by injecting SQL code through the msgid parameter in shoutedit.php. Exploitation of this vulnerability could lead to unauthorized access to database information, including database names, user credentials, and password hashes.

Impact

Exploitation of this vulnerability allows for unauthenticated SQL injection, enabling attackers to manipulate database queries and extract sensitive information such as database names, user credentials, and password hashes.

Reproduction

To reproduce this vulnerability, send a crafted request to the shoutedit.php file with the msgid parameter. Include SQL injection payloads that utilize the EXTRACTVALUE function to extract database information. This can be automated with tools like sqlmap.