MedDream PACS Premium Reflected Cross-Site Scripting Vulnerability

A reflected cross-site scripting vulnerability has been identified in the config.php functionality of MedDream PACS Premium version 7.3.6.870. This vulnerability allows for the execution of arbitrary JavaScript code. It arises because the application fails to properly sanitize user input in several parameters, including 'imagedir', 'archivedir', 'longtermdir', 'uploaddir', 'thumbnaildir', 'phpexe', 'phpdir', 'worklistsrc', and 'worklistscan'. An attacker can exploit this by sending a crafted URL that includes malicious JavaScript, which is then executed in the context of the user's browser.

Impact

Exploitation of this vulnerability allows for reflected cross-site scripting, where an attacker can inject and execute malicious scripts in the context of the user's session.

Reproduction

To reproduce this vulnerability, send a POST request to the 'config.php' script with one of the vulnerable parameters ('imagedir', 'archivedir', 'longtermdir', 'uploaddir', 'thumbnaildir', 'phpexe', 'phpdir', 'worklistsrc', or 'worklistscan') set to a value that includes JavaScript code, such as a script tag. The response will include the injected script executed as a part of the page.

Remediation

Users are advised to update to the patched version released by the vendor.