MedDream PACS Premium Reflected Cross-Site Scripting Vulnerability

A reflected cross-site scripting vulnerability has been identified in MedDream PACS Premium version 7.3.6.870, specifically within the modifyAutopurgeFilter functionality. This vulnerability allows an attacker to execute arbitrary JavaScript code by sending a crafted URL. The issue arises because the key parameter in the Pacs/modifyAutopurgeFilter.php script is not properly sanitized before being outputted as HTML.

Impact

Exploitation of this vulnerability allows for reflected cross-site scripting, where an attacker can inject and execute malicious JavaScript in the context of the user's browser.

Reproduction

To reproduce this vulnerability, send a GET request to the Pacs/modifyAutopurgeFilter.php endpoint with a crafted key parameter. The key parameter should be formatted to include a script tag, such as <script>alert(1)</script>. The response will include the injected script, executed as part of the page.

Remediation

Users are advised to update to the version released by the vendor on December 5, 2025.