cbcvebase.
CVE-2024-4257
published 2024-04-27

CVE-2024-4257: A vulnerability was found in BlueNet Technology Clinical Browsing System 1.2.1. It has been classified as critical. This affects an unknown part of the file…

PriorityP354medium6.5CVSS 3.1
AVNACLPRLUINSUCHINAN
EXPLOIT
EPSS
12.05%
95.6th percentile
A vulnerability was found in BlueNet Technology Clinical Browsing System 1.2.1. It has been classified as critical. This affects an unknown part of the file /xds/deleteStudy.php. The manipulation of the argument documentUniqueId leads to sql injection. It is possible to initiate the attack remotely. The exploit has been disclosed to the public and may be used. The identifier VDB-262149 was assigned to this vulnerability.

Affected

2 ranges
VendorProductVersion rangeFixed in
bluenet_technologyclinical_browsing_system——
bluenettechnologyclinical_browsing_system——

Detection & IOCsextracted from sources · hover to see the quote

path/xds/deleteStudy.php↗
url/xds/deleteStudy.php?documentUniqueId=1%27;WAITFOR%20DELAY%20%270:0:6%27--↗
command1';WAITFOR DELAY '0:0:6'--↗
  • →Use FOFA query 'app="LANWON-临床浏览系统"' to identify internet-exposed instances of the BlueNet Technology Clinical Browsing System. ↗
  • →The attack requires authentication (PR:L); monitor for authenticated sessions issuing GET requests to /xds/deleteStudy.php with SQL metacharacters (e.g., single-quote, semicolon, WAITFOR/DELAY keywords) in the documentUniqueId parameter. ↗
  • ·The WAITFOR DELAY payload is MSSQL-specific; the injection technique will only work against deployments backed by Microsoft SQL Server. ↗
  • ·The Nuclei template enforces a 20-second HTTP timeout (@timeout 20s) to accommodate the 6-second delay; detection rules or scanners must be configured with a sufficiently long timeout to avoid false negatives. ↗
  • ·Exploitation requires low-privilege authentication (CVSS PR:L), so unauthenticated probes to the endpoint will not trigger the vulnerability. ↗

CVSS provenance

nvdv3.16.5MEDIUMCVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N
nvdv2.06.5MEDIUMAV:N/AC:L/Au:S/C:P/I:P/A:P
CVEs like this are exactly what “Exploited This Week” covers.

Every Monday: what got weaponized or added to CISA KEV in the last seven days — each CVE cross-linked to its PoC, Nuclei template, and detection rule. Free, one email a week, unsubscribe in one click.