PT-2024-39418 · Unknown · Blood Bank System

Kev1Nk · Published 2024-09-22 · Updated 2025-08-19 · CVE-2024-9084

Positive Technologies (AI Summary)

CVSS v3.1

5.4

Medium

Base vector

AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:N

Name of the Vulnerable Software and Affected Versions Blood Bank System version 1.0

Description A problematic issue was found in the Blood Bank System, affecting unknown parts of the bbms.php file. The manipulation of the fullname, age, bloodgroup, city, phno, and gender arguments as part of a String leads to cross-site scripting. The attack can be initiated remotely. The exploit has been disclosed to the public and may be used.

Recommendations For version 1.0, consider disabling the vulnerable parts of the bbms.php file until a patch is available. Restrict access to the bbms.php file to minimize the risk of exploitation. Avoid using the fullname, age, bloodgroup, city, phno, and gender arguments in the affected API endpoints until the issue is resolved.

Exploit

Fix

DoS

RCE

XSS

Weakness Enumeration

CWE-79

Related Identifiers

CVE-2024-9084

Affected Products

Blood Bank System

References · 13

• 🔥 https://github.com/ByKevin1/CVE/blob/main/xss1.md · Exploit
• https://osv.dev/vulnerability/CVE-2024-9084 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2024-9084 · Security Note
• https://t.me/cvenotify/96153 · Telegram Post
• https://twitter.com/VulmonFeeds/status/1837805835151409489 · Twitter Post
• https://t.me/cvedetector/6157 · Telegram Post
• https://twitter.com/Cezar_H_Linux/status/1957868586434707950 · Twitter Post
• https://vuldb.com/?submit.411672 · Note
• https://vuldb.com/?id.278254 · Note
• https://twitter.com/CVEnew/status/1837782695268499942 · Twitter Post
• https://vuldb.com/?ctiid.278254 · Note
• https://t.me/cvenotify/95602 · Telegram Post
• https://code-projects.org · Note