CVE-2024-2275: Bdtask G-prescription XSS Vulnerability

CVE-2024-2275 Overview

CVE-2024-2275 is a stored cross-site scripting (XSS) vulnerability in Bdtask G-Prescription Gynaecology & OBS Consultation Software version 1.0. The flaw resides in the OBS Patient/Gynee Prescription component and is triggered by manipulating multiple user-supplied input fields. Affected fields include Patient Title, Full Name, Address, Cheif Complain, LMP, Menstrual Edd, OBS P, OBS Alc, Medicine Name, Medicine Type, Ml, Dose, Days, Comments, and Template Name. The vulnerability is remotely exploitable and public exploit details have been disclosed. The vendor was contacted early but did not respond.

Critical Impact
Remote attackers can inject persistent JavaScript into prescription records, enabling session hijacking, credential theft, and unauthorized actions in the context of clinical staff sessions.

Affected Products

Bdtask G-Prescription Gynaecology & OBS Consultation Software 1.0
OBS Patient/Gynee Prescription component
Deployments exposing the prescription entry interface to browser clients

Discovery Timeline

2024-03-08 - CVE-2024-2275 published to NVD
2026-06-17 - Last updated in NVD database

Technical Details for CVE-2024-2275

Vulnerability Analysis

The vulnerability is a cross-site scripting flaw classified under [CWE-79]. The application accepts prescription-related input from users and renders it back into web pages without proper output encoding or input sanitization. Because the affected inputs are stored fields tied to patient records and prescription templates, injected payloads persist and execute in every browser session that later views the affected data.

Exploitation requires user interaction, meaning a clinician or administrator must load the page containing the injected payload. Once triggered, the payload runs in the victim's browser under the origin of the vulnerable application. Attackers can steal session cookies, perform actions on behalf of authenticated users, or redirect victims to attacker-controlled infrastructure.

Root Cause

The root cause is missing input validation and output encoding across multiple prescription and patient data fields in the OBS Patient/Gynee Prescription component. The application treats user-supplied strings as trusted content when rendering them into HTML responses, allowing script tags and event handlers to execute in the browser context.

Attack Vector

The attack is delivered over the network. An attacker with access to submit or edit prescription data injects a JavaScript payload into any of the vulnerable fields. When another authenticated user, typically medical staff, views the record, the payload executes in their browser. See the VulDB entry #256044 for public disclosure details.

No verified proof-of-concept code is included here. The vulnerability mechanism is standard stored XSS: unsanitized input in one of the listed fields is echoed into an HTML response without encoding.

Detection Methods for CVE-2024-2275

Indicators of Compromise

Prescription or patient records containing HTML tags such as <script>, <img onerror=>, or <svg onload=> in fields like Full Name, Address, Comments, or Template Name
Outbound browser requests from clinical workstations to unfamiliar external domains shortly after accessing prescription views
Unexpected session terminations or authentication anomalies for staff accounts that recently viewed patient records

Detection Strategies

Perform database queries against prescription and patient tables to search stored field values for HTML control characters and script-like patterns
Enable server-side request logging and inspect POST parameters submitted to prescription creation and update endpoints for XSS payload signatures
Deploy a web application firewall (WAF) with XSS rule sets in monitoring mode to identify inbound injection attempts

Monitoring Recommendations

Monitor browser telemetry from workstations that access the G-Prescription application for anomalous script execution and outbound connections
Alert on authenticated sessions performing unusual API calls immediately after loading prescription pages
Track user account behavior for signs of session theft, such as concurrent logins from disparate IP addresses

How to Mitigate CVE-2024-2275

Immediate Actions Required

Restrict network access to the G-Prescription application to trusted internal networks and VPN users only
Audit stored prescription and template records for injected HTML or JavaScript content and sanitize affected entries
Enforce least-privilege access so that only necessary staff can create or edit prescriptions and templates

Patch Information

No vendor patch is available. According to the disclosure, the vendor was contacted about this vulnerability but did not respond. Organizations running Bdtask G-Prescription Gynaecology & OBS Consultation Software 1.0 should assume the flaw remains unfixed and apply compensating controls. Monitor the VulDB advisory for future updates.

Workarounds

Deploy a web application firewall in front of the application with rules that block common XSS payloads targeting the affected fields
Configure a strict Content Security Policy (CSP) response header to disable inline scripts and restrict script sources
Set HttpOnly and Secure flags on session cookies to limit the impact of script-based session theft
Consider migrating to an actively maintained prescription management platform if the vendor remains unresponsive

bash

# Example nginx configuration adding CSP and cookie hardening
add_header Content-Security-Policy "default-src 'self'; script-src 'self'; object-src 'none'; base-uri 'self'";
add_header X-Content-Type-Options "nosniff";
add_header X-Frame-Options "DENY";
proxy_cookie_flags ~ HttpOnly Secure SameSite=Strict;