CVE-2024-2275

  1. OpenCVE
  2. Vulnerabilities (CVE)
  3. CVE-2024-2275
A vulnerability, which was classified as problematic, was found in Bdtask G-Prescription Gynaecology & OBS Consultation Software 1.0. Affected is an unknown function of the component OBS Patient/Gynee Prescription. The manipulation of the argument Patient Title/Full Name/Address/Cheif Complain/LMP/Menstrual Edd/OBS P/OBS Alc/Medicine Name/Medicine Type/Ml/Dose/Days/Comments/Template Name leads to cross site scripting. It is possible to launch the attack remotely. The exploit has been disclosed to the public and may be used. The identifier of this vulnerability is VDB-256044. NOTE: The vendor was contacted early about this disclosure but did not respond in any way.

2.4 /10

CVSS v3 : LOW

V3 Legend

Vector :

Exploitability : 0.9 / Impact : 1.4

Attack Vector NETWORK

Attack Complexity LOW

Privileges Required HIGH

User Interaction REQUIRED

Confidentiality Impact NONE

Integrity Impact LOW

Availability Impact NONE

Scope UNCHANGED

3.3 /10

CVSS v2.0 : LOW

V2 Legend

Vector : AV:N/AC:L/Au:M/C:N/I:P/A:N

Exploitability : 6.4 / Impact : 2.9

Access Vector NETWORK

Access Complexity LOW

Authentication MULTIPLE

Confidentiality Impact NONE

Integrity Impact PARTIAL

Availability Impact NONE

References
Link Resource
https://drive.google.com/file/d/11QliZKy-7ylKph1vwlXVHaRn5Jmk0Bjg/view?usp=drivesdk Exploit
https://vuldb.com/?ctiid.256044 Permissions Required
https://vuldb.com/?id.256044 Permissions Required
https://drive.google.com/file/d/11QliZKy-7ylKph1vwlXVHaRn5Jmk0Bjg/view?usp=drivesdk Exploit
https://vuldb.com/?ctiid.256044 Permissions Required
https://vuldb.com/?id.256044 Permissions Required
Configurations

Configuration 1 (hide)

cpe:2.3:a:bdtask:g-prescription_gynaecology_\&_obs_consultation:1.0:*:*:*:*:*:*:*
History

12 Mar 2025, 13:26

Type Values Removed Values Added
First Time Bdtask
Bdtask g-prescription Gynaecology \& Obs Consultation
References () https://drive.google.com/file/d/11QliZKy-7ylKph1vwlXVHaRn5Jmk0Bjg/view?usp=drivesdk - () https://drive.google.com/file/d/11QliZKy-7ylKph1vwlXVHaRn5Jmk0Bjg/view?usp=drivesdk - Exploit
References () https://vuldb.com/?ctiid.256044 - () https://vuldb.com/?ctiid.256044 - Permissions Required
References () https://vuldb.com/?id.256044 - () https://vuldb.com/?id.256044 - Permissions Required
CPE cpe:2.3:a:bdtask:g-prescription_gynaecology_\&_obs_consultation:1.0:*:*:*:*:*:*:*

21 Nov 2024, 09:09

Type Values Removed Values Added
References () https://drive.google.com/file/d/11QliZKy-7ylKph1vwlXVHaRn5Jmk0Bjg/view?usp=drivesdk - () https://drive.google.com/file/d/11QliZKy-7ylKph1vwlXVHaRn5Jmk0Bjg/view?usp=drivesdk -
References () https://vuldb.com/?ctiid.256044 - () https://vuldb.com/?ctiid.256044 -
References () https://vuldb.com/?id.256044 - () https://vuldb.com/?id.256044 -

08 Mar 2024, 14:02

Type Values Removed Values Added
Summary
  • (es) Una vulnerabilidad fue encontrada en Bdtask G-Prescription Gynecology & OBS Consultation Software 1.0 y clasificada como problemática. Una función desconocida del componente OBS Patient/Gynee Prescription es afectada por esta función. La manipulación del argumento Título del paciente/Nombre completo/Dirección/Queja del jefe/LMP/Edd menstrual/OBS P/OBS Alc/Nombre del medicamento/Tipo de medicamento/Ml/Dosis/Días/Comentarios/Nombre de la plantilla conduce a cross site scripting. Es posible lanzar el ataque de forma remota. El exploit ha sido divulgado al público y puede utilizarse. El identificador de esta vulnerabilidad es VDB-256044. NOTA: Se contactó primeramente con el proveedor sobre esta divulgación, pero no respondió de ninguna manera.

08 Mar 2024, 01:15

Type Values Removed Values Added
New CVE
Information

Published : 2024-03-08 01:15

Updated : 2025-03-12 13:26

NVD link : CVE-2024-2275

Mitre link : CVE-2024-2275

CVE.ORG link : CVE-2024-2275

JSON object : View

Products Affected

bdtask

  • g-prescription_gynaecology_\&_obs_consultation
CWE
CWE-79

Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')