CVE-2024-4257CWE-89

BlueNet Technology Clinical Browsing System deleteStudy.php sql injection

Medium · published April 27, 2024

CVSS v3.1

6.3

EPSS

12%

Percentile

96.1

In the wild

Unconfirmed

What it is

A vulnerability was found in BlueNet Technology Clinical Browsing System 1.2.1. It has been classified as critical. This affects an unknown part of the file /xds/deleteStudy.php. The manipulation of the argument documentUniqueId leads to sql injection. It is possible to initiate the attack remotely. The exploit has been disclosed to the public and may be used. The identifier VDB-262149 was assigned to this vulnerability.

The record

Technical detail

CVSS v3.1: 6.3 · MEDIUM
Vector: CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:L
CVSS v4.0: Not supplied
EPSS: 0.12051 · 96.1th percentile
Weakness: CWE-89 · Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection')
Published: 2024-04-27T16:00Z

EPSS history

Timeline

27 APR 16:00Z
BlueNet Technology Clinical Browsing System deleteStudy.php sql injection
cvelistv5