MedDream PACS Premium Reflected Cross-Site Scripting Vulnerability

A reflected cross-site scripting vulnerability has been identified in MedDream PACS Premium version 7.3.6.870. This vulnerability arises in the encapsulatedDoc functionality, where the 'mimetype' parameter is not properly sanitized before being outputted as HTML. As a result, an attacker can craft a malicious URL that executes arbitrary JavaScript code. The issue is present in the 'Pacs/encapsulatedDoc.php' script, part of the web-based DICOM viewer and administration interface of the MedDream PACS server.

Impact

Exploitation of this vulnerability allows for reflected cross-site scripting, where an attacker can inject and execute malicious JavaScript in the context of the user's browser.

Reproduction

To reproduce this vulnerability, send a request to the 'Pacs/encapsulatedDoc.php' script with a crafted 'mimetype' parameter that includes JavaScript code, such as a script tag. The response will include the injected script executed as JavaScript, demonstrating the cross-site scripting vulnerability.

Remediation

Users are advised to update to the patched version released by the vendor on December 5, 2025.