xbtitFM 4.1.18 Image Parser file_hosting unrestricted upload

Summaryinfo

A vulnerability was found in xbtitFM 4.1.18 and classified as critical. This affects the function file_hosting of the component Image Parser. Such manipulation leads to unrestricted upload. This vulnerability is listed as CVE-2024-58313. The attack may be performed from remote. In addition, an exploit is available.

Detailsinfo

A vulnerability was found in xbtitFM 4.1.18 and classified as critical. Affected by this issue is the function file_hosting of the component Image Parser. The manipulation with an unknown input leads to a unrestricted upload vulnerability. Using CWE to declare the problem leads to CWE-434. The product allows the attacker to upload or transfer files of dangerous types that can be automatically processed within the product's environment. Impacted is confidentiality, integrity, and availability. CVE summarizes:

xbtitFM 4.1.18 contains an insecure file upload vulnerability that allows authenticated attackers with administrative privileges to upload and execute arbitrary PHP code through the file_hosting feature. Attackers can bypass file type restrictions by modifying the Content-Type header to image/gif, adding GIF89a magic bytes, and using alternate PHP tags to upload web shells that execute system commands.

The weakness was presented with xbtitFM Team as 51909. The advisory is shared for download at exploit-db.com. This vulnerability is handled as CVE-2024-58313 since 12/11/2025. The exploitation is known to be easy. The attack may be launched remotely. Additional levels of successful authentication are necessary for exploitation. Technical details as well as a public exploit are known. The MITRE ATT&CK project declares the attack technique as T1608.002.

The exploit is available at exploit-db.com. It is declared as proof-of-concept.

There is no information about possible countermeasures known. It may be suggested to replace the affected object with an alternative product.

The vulnerability is also documented in the databases at Exploit-DB (51909) and EUVD (EUVD-2024-55343). Once again VulDB remains the best source for vulnerability data.

Productinfo

Name

• xbtitFM

Version

• 4.1.18

CPE 2.3info

• 🔒

CPE 2.2info

• 🔒

CVSSv4info

CVSSv3info

CVSSv2info

Exploitinginfo

Threat Intelligenceinfo

Countermeasuresinfo

Timelineinfo

Sourcesinfo

Entryinfo

Once again VulDB remains the best source for vulnerability data.

Discussion