CVE-2024-58290 is a SQL injection vulnerability affecting Elements' Xhibiter NFT Marketplace version 1.10.2. The issue resides in the collections endpoint where the 'id' parameter is improperly neutralized, allowing attackers to inject malicious SQL commands. Attackers can leverage multiple SQL injection techniques including boolean-based, time-based, and UNION-based methods to manipulate or extract data from the backend database. The vulnerability is remotely exploitable without authentication or user interaction, resulting in a critical security risk.

Successful exploitation of this vulnerability could allow an unauthenticated attacker to execute arbitrary SQL commands on the backend database. This may lead to unauthorized disclosure, modification, or deletion of sensitive data stored by the marketplace. Given the critical CVSS score of 9.3, the impact is severe, potentially compromising the confidentiality and integrity of the marketplace's data.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until an official fix is released, users should consider restricting access to the vulnerable endpoint or implementing web application firewall (WAF) rules to detect and block SQL injection attempts targeting the 'id' parameter in the collections endpoint. Monitor vendor communications for updates on patches or official mitigations.