CVE-2024-2276: Bdtask G-prescription XSS Vulnerability

CVE-2024-2276 Overview

CVE-2024-2276 is a reflected cross-site scripting (XSS) vulnerability in Bdtask G-Prescription Gynaecology & OBS Consultation Software version 1.0. The flaw resides in the /Venue_controller/edit_venue/ endpoint of the Edit Venue Page component. Attackers can manipulate the Venue map parameter to inject arbitrary script content that executes in the victim's browser session. The vulnerability is remotely exploitable and requires user interaction. Public disclosure has already occurred through VulDB entry 256045, and the vendor did not respond to disclosure attempts.

Critical Impact
Remote attackers can execute arbitrary JavaScript in an authenticated user's browser, potentially hijacking sessions or performing unauthorized actions within the clinical application.

Affected Products

Bdtask G-Prescription Gynaecology & OBS Consultation Software 1.0
Edit Venue Page component (/Venue_controller/edit_venue/)
Deployments exposing the Venue map input field

Discovery Timeline

2024-03-08 - CVE-2024-2276 published to the National Vulnerability Database (NVD)
2026-06-17 - Last updated in NVD database

Technical Details for CVE-2024-2276

Vulnerability Analysis

The vulnerability is a stored or reflected cross-site scripting flaw classified under CWE-79. The Edit Venue Page accepts input for the Venue map argument without properly sanitizing or encoding the data before rendering it back into the HTML response. An attacker who can influence this parameter can embed JavaScript payloads that execute when a legitimate user opens the affected page.

Because the application is a clinical consultation platform for gynaecology and obstetrics, successful exploitation can expose sensitive patient data, session cookies, or authenticated API tokens. The scope change indicated in the CVSS vector suggests that the injected script executes in a security context different from the vulnerable component, amplifying the impact on adjacent browser resources.

Root Cause

The root cause is missing or insufficient output encoding in the view logic that renders the Venue map value. User-controlled data is written directly into the HTML DOM without contextual escaping, allowing <script> tags and event handler attributes to be interpreted as executable code.

Attack Vector

An attacker crafts a malicious URL or form submission containing a JavaScript payload in the Venue map field. Delivering this link to an authenticated user through phishing or social engineering triggers execution of the payload in the victim's browser. The payload can steal session tokens, perform actions on behalf of the user, or redirect to attacker-controlled infrastructure. No authentication is required to launch the request, but user interaction is required for the payload to execute.

No verified proof-of-concept code is available. Refer to the VulDB entry #256045 and the supporting disclosure file for reproduction details.

Detection Methods for CVE-2024-2276

Indicators of Compromise

HTTP requests to /Venue_controller/edit_venue/ containing <script>, onerror=, onload=, or javascript: payloads in the Venue map parameter
Outbound browser requests from clinician workstations to unfamiliar domains immediately after loading the Edit Venue page
Unexpected session token reuse from geographically anomalous IP addresses

Detection Strategies

Deploy web application firewall (WAF) rules that inspect POST and GET parameters submitted to /Venue_controller/edit_venue/ for common XSS signatures
Enable content security policy (CSP) violation reporting to surface inline script execution on Edit Venue pages
Review application access logs for encoded payloads such as %3Cscript%3E targeting the Venue controller

Monitoring Recommendations

Correlate authenticated user sessions with outbound HTTP requests to non-approved domains from clinical endpoints
Alert on repeated failed input validation errors from the Venue controller within short time windows
Track browser console errors and CSP reports aggregated from clinician workstations for evidence of injected scripts

How to Mitigate CVE-2024-2276

Immediate Actions Required

Restrict access to /Venue_controller/edit_venue/ to trusted internal networks or VPN-connected users only
Apply a WAF rule set that blocks HTML and JavaScript metacharacters in the Venue map parameter
Audit existing Venue records for previously stored payloads and remove any suspicious entries

Patch Information

No vendor patch is available. The vendor did not respond to disclosure attempts documented in VulDB CTI #256045. Operators should treat this as an unpatched vulnerability and apply compensating controls until Bdtask releases a fix. Consider engaging the vendor directly through commercial support channels to request a security update.

Workarounds

Implement a strict Content Security Policy that disallows inline scripts and restricts script sources to trusted origins
Enforce server-side input validation that rejects HTML tags and JavaScript event handlers in the Venue map field
Apply output encoding at the template layer using context-aware HTML escaping for all user-supplied data rendered on the Edit Venue page
Require re-authentication for sensitive actions to limit the utility of stolen session tokens

bash

# Example ModSecurity rule to block XSS payloads targeting the vulnerable endpoint
SecRule REQUEST_URI "@beginsWith /Venue_controller/edit_venue/" \
    "phase:2,chain,deny,status:403,id:1002276,\
    msg:'CVE-2024-2276 XSS attempt in Venue map parameter'"
    SecRule ARGS:"Venue map" "@rx (?i)(<script|onerror=|onload=|javascript:)" \
        "t:none,t:urlDecodeUni,t:htmlEntityDecode"