CVE-2025-58090
📋 TL;DR
MedDream PACS Premium 7.3.6.870 contains reflected cross-site scripting vulnerabilities in the config.php uploaddir parameter. Attackers can craft malicious URLs that execute arbitrary JavaScript in victims' browsers when visited. This affects all users of the vulnerable version who access the application.
💻 Affected Systems
- MedDream PACS Premium
📦 What is this software?
Pacs Server by Meddream
⚠️ Risk & Real-World Impact
Worst Case
Attackers could steal session cookies, perform actions as authenticated users, redirect to malicious sites, or install malware on client systems.
Likely Case
Session hijacking, credential theft, or defacement of the application interface through injected content.
If Mitigated
Limited impact if proper input validation and output encoding are implemented, though some client-side disruption may still occur.
🎯 Exploit Status
Reflected XSS typically requires user interaction (clicking malicious link) but is straightforward to exploit once crafted.
🛠️ Fix & Mitigation
✅ Official Fix
Patch Version: Unknown
Vendor Advisory: https://talosintelligence.com/vulnerability_reports/TALOS-2025-2271
Restart Required: No
Instructions:
1. Check vendor website for security updates. 2. Apply any available patches for MedDream PACS Premium. 3. Verify the fix by testing the uploaddir parameter.
🔧 Temporary Workarounds
Web Application Firewall (WAF)
allDeploy a WAF with XSS protection rules to block malicious requests.
Input Validation Filter
allImplement server-side input validation to sanitize the uploaddir parameter.
🧯 If You Can't Patch
- Restrict access to the application using network segmentation or VPN.
- Implement Content Security Policy (CSP) headers to mitigate script execution.
🔍 How to Verify
Check if Vulnerable:
Test the config.php uploaddir parameter with XSS payloads like <script>alert('XSS')</script> and observe if script executes.Check Version:
Check application version in admin interface or configuration files.Verify Fix Applied:
Retest with XSS payloads after applying fixes; ensure no script execution occurs and input is properly sanitized.📡 Detection & Monitoring
Log Indicators:
- HTTP requests to config.php with suspicious parameters containing script tags or JavaScript code.
Network Indicators:
- Unusual outbound connections from client browsers after visiting application URLs.
SIEM Query:
source="web_logs" AND uri="*config.php*" AND (param="*<script>*" OR param="*javascript:*")