PatchSiren cyber security CVE debrief
CVE-2018-25372 MedDream CVE debrief
MedDream PACS Server Premium 6.7.1.1 contains an unauthenticated SQL injection vulnerability in the userSignup.php endpoint. The email parameter fails to properly sanitize user input, allowing attackers to inject malicious SQL payloads via crafted POST requests. Successful exploitation enables arbitrary SQL query execution against the backend MySQL database, potentially exposing sensitive patient data, authentication credentials, and system configuration information. The vulnerability carries a HIGH severity CVSS score of 8.8, reflecting significant confidentiality and integrity impacts without requiring authentication or user interaction.
- Vendor
- MedDream
- Product
- PACS Server Premium
- CVSS
- HIGH 8.8
- CISA KEV
- Not listed in stored evidence
- Original CVE published
- 2026-05-25
- Original CVE updated
- 2026-05-26
- Advisory published
- 2026-05-25
- Advisory updated
- 2026-05-26
Who should care
Healthcare organizations operating MedDream PACS Server Premium installations; medical imaging departments; hospital IT security teams; HIPAA compliance officers; medical device security assessors
Technical summary
The vulnerability exists in the userSignup.php endpoint where the email parameter accepts unsanitized user input directly into SQL queries. Attackers can submit POST requests containing SQL injection payloads in the email field to manipulate database queries. The backend MySQL database processes these injected commands, allowing data extraction, authentication bypass, or potential database modification. No authentication is required to reach the vulnerable endpoint, significantly lowering the barrier to exploitation.
Defensive priority
HIGH
Recommended defensive actions
- Apply vendor patches for MedDream PACS Server Premium 6.7.1.1 or upgrade to a non-vulnerable version
- Implement parameterized queries and prepared statements for all database interactions
- Deploy Web Application Firewall (WAF) rules to detect and block SQL injection patterns in POST requests to userSignup.php
- Conduct code review of authentication and user registration endpoints for additional injection vulnerabilities
- Enable comprehensive logging and monitoring for suspicious database query patterns and failed authentication attempts
- Restrict network access to PACS administrative interfaces to authorized IP ranges only
- Perform database activity monitoring to detect anomalous query execution indicative of exploitation
Evidence notes
Vulnerability disclosed via Exploit-DB and VulnCheck advisory. NVD record shows Deferred status with CVSS 4.0 vector. CWE-89 (SQL Injection) confirmed as primary weakness.
Official resources
2026-05-25