CVE-2025-58093
📋 TL;DR
Multiple reflected cross-site scripting vulnerabilities in MedDream PACS Premium allow attackers to execute arbitrary JavaScript code via specially crafted URLs targeting the phpdir parameter. This affects users of MedDream PACS Premium 7.3.6.870 who access malicious links, potentially leading to session hijacking or credential theft.
💻 Affected Systems
- MedDream PACS Premium
📦 What is this software?
Pacs Server by Meddream
⚠️ Risk & Real-World Impact
Worst Case
Attackers could steal session cookies, perform actions as authenticated users, redirect to malicious sites, or install malware on user systems.
Likely Case
Session hijacking, credential theft, or redirection to phishing sites when users click malicious links.
If Mitigated
Limited impact with proper input validation, output encoding, and Content Security Policy headers in place.
🎯 Exploit Status
Reflected XSS typically requires user interaction but is easy to weaponize in phishing campaigns.
🛠️ Fix & Mitigation
✅ Official Fix
Patch Version: Unknown
Vendor Advisory: https://talosintelligence.com/vulnerability_reports/TALOS-2025-2271
Restart Required: No
Instructions:
1. Contact MedDream for patch availability. 2. Apply vendor-provided patch. 3. Test functionality after patching.
🔧 Temporary Workarounds
Input Validation and Output Encoding
allImplement proper input validation and output encoding for the phpdir parameter in config.php
Content Security Policy
allImplement strict Content Security Policy headers to mitigate XSS impact
🧯 If You Can't Patch
- Implement web application firewall (WAF) rules to block XSS payloads targeting phpdir parameter
- Educate users about phishing risks and implement URL filtering
🔍 How to Verify
Check if Vulnerable:
Test by injecting XSS payloads into phpdir parameter in config.php URLs and checking for script executionCheck Version:
Check MedDream PACS Premium version in administration interface or configuration filesVerify Fix Applied:
Verify input validation and output encoding prevent script execution in phpdir parameter📡 Detection & Monitoring
Log Indicators:
- Unusual URL parameters containing script tags or JavaScript in phpdir parameter
- Multiple failed XSS attempts
Network Indicators:
- HTTP requests with suspicious phpdir parameter values containing script tags or JavaScript
SIEM Query:
source="web_logs" AND (phpdir CONTAINS "<script>" OR phpdir CONTAINS "javascript:")