CVE-2024-4257

BlueNet Technology Clinical Browsing System deleteStudy.php sql injection

CVSS 6.3 MEDIUMEPSS 12.1%CWE-89

Vexday Risk Score

33Atención

Decisión SSVC (CISA)

Attend

PoC disponible → seguir de cerca

CVSS 6.3EPSS 12.1%KEV nãoPoC —Nuclei simMetasploit —Patch —

Ciclo de vida

27 abr 2024Publicada en NVD

Recomendación: Planificar corrección próxima — ya existe PoC pública.

A vulnerability was found in BlueNet Technology Clinical Browsing System 1.2.1. It has been classified as critical. This affects an unknown part of the file /xds/deleteStudy.php. The manipulation of the argument documentUniqueId leads to sql injection. It is possible to initiate the attack remotely. The exploit has been disclosed to the public and may be used. The identifier VDB-262149 was assigned to this vulnerability.

CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:L

Productos afectados

BlueNet Technology · Clinical Browsing System

¿Quieres saber si tu infraestructura está expuesta a esto?

Hablar con TrueHacking →

Referencias

https://github.com/GAO-UNO/cve/blob/main/sql.md https://vuldb.com/?ctiid.262149 https://vuldb.com/?id.262149 https://vuldb.com/?submit.321338