Vulnerabilities
Vulnerable Software
Btiteam:  >> Xbtit  Security Vulnerabilities
A cross-site scripting vulnerability is present in Xbtit 3.1. The stored XSS vulnerability occurs because /ajaxchat/sendChatData.php does not properly validate the value of the "n" (POST) parameter. Through this vulnerability, an attacker is capable to execute malicious JavaScript code.
CVSS Score
6.1
EPSS Score
0.003
Published
2022-03-16
A blind SQL injection vulnerability exists in Xbtit 3.1 via the sid parameter in ajaxchat/getHistoryChatData.php file that is accessible by a registered user. As a result, a malicious user can extract sensitive data such as usernames and passwords and in some cases use this vulnerability in order to get a remote code execution on the remote web server.
CVSS Score
8.8
EPSS Score
0.019
Published
2022-03-16
An issue was discovered in BTITeam XBTIT 2.5.4. The "returnto" parameter of account_change.php is vulnerable to an open redirect, a different vulnerability than CVE-2018-15683.
CVSS Score
6.1
EPSS Score
0.002
Published
2018-10-01
An issue was discovered in BTITeam XBTIT 2.5.4. news.php allows XSS via the id parameter.
CVSS Score
6.1
EPSS Score
0.002
Published
2018-09-05
An issue was discovered in BTITeam XBTIT. PHP error logs are stored in an open directory (/include/logs) using predictable file names, which can lead to full path disclosure and leakage of sensitive data.
CVSS Score
5.3
EPSS Score
0.002
Published
2018-09-05
An issue was discovered in BTITeam XBTIT. By using String.replace and eval, it is possible to bypass the includes/crk_protection.php anti-XSS mechanism that looks for a number of dangerous fingerprints.
CVSS Score
5.3
EPSS Score
0.002
Published
2018-09-05
The newsfeed (aka /index.php?page=viewnews) in BTITeam XBTIT 2.5.4 has stored XSS via the title of a news item. This is also exploitable via CSRF.
CVSS Score
6.1
EPSS Score
0.001
Published
2018-09-05
An issue was discovered in BTITeam XBTIT 2.5.4. The "act" parameter in the sign-up page available at /index.php?page=signup is vulnerable to reflected cross-site scripting.
CVSS Score
6.1
EPSS Score
0.002
Published
2018-09-05
An issue was discovered in BTITeam XBTIT 2.5.4. The "keywords" parameter in the search function available at /index.php?page=forums&action=search is vulnerable to reflected cross-site scripting.
CVSS Score
6.1
EPSS Score
0.002
Published
2018-09-05
An issue was discovered in BTITeam XBTIT 2.5.4. The hashed passwords stored in the xbtit_users table are stored as unsalted MD5 hashes, which makes it easier for context-dependent attackers to obtain cleartext values via a brute-force attack.
CVSS Score
9.8
EPSS Score
0.002
Published
2018-09-05


Contact Us

Shodan ® - All rights reserved