MedDream PACS Premium Reflected Cross-Site Scripting Vulnerability in config.php

A reflected cross-site scripting vulnerability has been identified in the config.php file of MedDream PACS Premium version 7.3.6.870. This vulnerability allows attackers to execute arbitrary JavaScript by sending specially crafted URLs that exploit the unvalidated status parameter. The issue arises because the application fails to properly sanitize user input before displaying it on the web page.

Impact

Exploitation of this vulnerability allows for reflected cross-site scripting, where an attacker can inject and execute malicious scripts in the context of the user's browser.

Reproduction

To reproduce this vulnerability, send a GET request to the Pacs/config.php endpoint with a crafted status parameter that includes unsanitized JavaScript, such as a script tag with JavaScript code, such as an alert. The injected script will be executed in the context of the user's browser.

Remediation

Users are advised to update to the patched version released by the vendor.