MedDream PACS Premium Reflected Cross-Site Scripting Vulnerability

A reflected cross-site scripting vulnerability has been identified in the autoPurge feature of MedDream PACS Premium version 7.3.6.870. This vulnerability allows an attacker to execute arbitrary JavaScript by sending a specially crafted URL. The issue arises because the 'purgeby' parameter in the 'Pacs/autoPurge.php' script is not properly sanitized before being outputted as HTML.

Impact

Exploitation of this vulnerability allows for reflected cross-site scripting, where an attacker can inject and execute malicious JavaScript in the context of the user's browser.

Reproduction

To reproduce this vulnerability, send a POST request to 'Pacs/autoPurge.php' with the 'actionvalue' parameter set to 'Modify' and the 'purgeby' parameter containing the injected script, such as a JavaScript alert. The response will include the injected script, executed as part of the HTML.

Remediation

Users are advised to update to the patched version released by the vendor on December 5, 2025.