Can you explain this vulnerability to me?

This vulnerability is a reflected cross-site scripting (XSS) issue in the modifyAutopurgeFilter functionality of MedDream PACS Premium 7.3.6.870. It occurs because the application takes a "key" parameter from the URL without proper sanitization and embeds it directly into the HTML response. An attacker can craft a malicious URL containing JavaScript code in the "key" parameter, which gets executed in the victim's browser when they visit the URL. This allows arbitrary JavaScript execution via the web interface. [1]

Useful 0 Not Useful 0

How can this vulnerability impact me? :

This vulnerability can allow an attacker to execute arbitrary JavaScript code in the context of the victim's browser session. This can lead to theft of sensitive information such as session cookies, user credentials, or other data accessible via the browser. It may also enable actions on behalf of the user, such as unauthorized operations within the MedDream PACS web interface, potentially compromising the confidentiality and integrity of medical image data. [1]

Useful 0 Not Useful 0

How can this vulnerability be detected on my network or system? Can you suggest some commands?

This vulnerability can be detected by monitoring web server logs for requests to the /Pacs/modifyAutopurgeFilter.php endpoint containing the 'key' parameter with suspicious or malicious payloads, such as JavaScript code snippets (e.g., <script>alert(1)</script>). A practical approach is to search for HTTP GET requests with the 'key' parameter including script tags or unusual characters. For example, using grep on web server logs: grep 'modifyAutopurgeFilter.php?key=' /path/to/access.log | grep '<script>' or similar patterns. Additionally, manual testing by sending crafted URLs like GET /Pacs/modifyAutopurgeFilter.php?key=AAA|31337|<script>alert(1)</script> to the application and observing if the script executes can confirm the presence of the vulnerability. [1]

Useful 0 Not Useful 0

What immediate steps should I take to mitigate this vulnerability?

Immediate mitigation steps include applying the vendor-provided patch released on 2025-12-05 that fixes the input sanitization issue in the modifyAutopurgeFilter functionality. Until the patch is applied, restrict access to the vulnerable endpoint to trusted users only, implement web application firewall (WAF) rules to detect and block requests containing suspicious 'key' parameter values with script tags or other malicious payloads, and educate users to avoid clicking on untrusted URLs. Additionally, consider disabling or restricting the modifyAutopurgeFilter functionality if possible. [1]

Useful 0 Not Useful 0

How does this vulnerability affect compliance with common standards and regulations (like GDPR, HIPAA)?:

The provided resources do not specify how this reflected XSS vulnerability in MedDream PACS Premium affects compliance with common standards and regulations such as GDPR or HIPAA.

Useful 0 Not Useful 0