CVE-2018-25372: MedDream PACS Server SQL Injection Flaw

CVE-2018-25372 Overview

CVE-2018-25372 is an SQL injection vulnerability [CWE-89] in MedDream PACS Server Premium version 6.7.1.1. The flaw resides in the userSignup.php endpoint, where the email parameter is passed to backend MySQL queries without proper sanitization. Unauthenticated attackers can submit crafted POST requests containing SQL payloads in the email field to execute arbitrary queries against the database. Successful exploitation allows extraction of sensitive medical and authentication data stored by the Picture Archiving and Communication System (PACS).

Critical Impact

Unauthenticated remote attackers can extract sensitive database contents from MedDream PACS Server Premium 6.7.1.1 through SQL injection in the user signup endpoint.

Affected Products

• MedDream PACS Server Premium 6.7.1.1
• userSignup.php endpoint component
• Backend MySQL database integration

Discovery Timeline

• 2026-05-25 - CVE-2018-25372 published to NVD
• 2026-05-26 - Last updated in NVD database

Technical Details for CVE-2018-25372

Vulnerability Analysis

The vulnerability is a classic SQL injection flaw in the user registration workflow of MedDream PACS Server Premium 6.7.1.1. The userSignup.php script accepts a POST parameter named email and concatenates it directly into a SQL query executed against the MySQL backend. Because no parameterized queries or input filtering are applied, attackers can break out of the intended string context and append arbitrary SQL syntax.

The endpoint requires no authentication, which removes the most common barrier to exploitation. Attackers can use boolean-based, error-based, or UNION-based injection techniques to enumerate database schemas, dump user credentials, and exfiltrate Digital Imaging and Communications in Medicine (DICOM) metadata. Healthcare environments running this PACS software are particularly exposed because the database typically contains protected health information (PHI).

Root Cause

The root cause is the absence of prepared statements in the signup handler. User-supplied data from the email POST field is interpolated into a SQL string rather than bound as a parameter. This pattern matches the conditions described by [CWE-89: Improper Neutralization of Special Elements used in an SQL Command].

Attack Vector

Exploitation requires network access to the PACS web interface and a single crafted HTTP POST request to userSignup.php. The attacker places SQL metacharacters and payloads in the email field. The server returns differential responses or injected data depending on the payload type, enabling iterative extraction of database contents. Public exploit details are available in Exploit-DB #45344 and the VulnCheck advisory.

Detection Methods for CVE-2018-25372

Indicators of Compromise

• POST requests to /userSignup.php containing SQL metacharacters such as single quotes, UNION SELECT, SLEEP(, or -- comment sequences in the email parameter.
• MySQL error log entries showing syntax errors originating from the PACS application user during signup activity.
• Unexpected large result sets or repeated failed signup attempts from the same source IP address.

Detection Strategies

• Inspect web server access logs for userSignup.php requests with abnormally long or encoded email values.
• Deploy a web application firewall (WAF) rule set with SQL injection signatures applied to the PACS signup endpoint.
• Correlate MySQL query anomalies, such as INFORMATION_SCHEMA enumeration, with HTTP traffic to the PACS host.

Monitoring Recommendations

• Enable verbose query logging on the MySQL backend during incident response to capture injected statements.
• Alert on outbound data transfers from the PACS server that exceed normal baselines, indicating possible exfiltration.
• Monitor authentication and database account activity for unauthorized access following suspicious signup requests.

How to Mitigate CVE-2018-25372

Immediate Actions Required

• Restrict network access to the MedDream PACS web interface using firewall rules or VPN segmentation until a vendor patch is applied.
• Disable or block the userSignup.php endpoint at the reverse proxy if user self-registration is not required.
• Audit the MySQL database for unauthorized accounts, modified records, or signs of prior data extraction.

Patch Information

No vendor patch URL is referenced in the available CVE data. Operators of MedDream PACS Server Premium 6.7.1.1 should contact MedDream directly for an updated build that replaces vulnerable signup logic with parameterized queries. Review the VulnCheck advisory for remediation status.

Workarounds

• Place the PACS application behind a WAF configured to block SQL injection patterns on the email parameter.
• Enforce least-privilege permissions on the MySQL account used by the PACS application to limit damage from injected queries.
• Implement input validation at the reverse proxy layer to reject email values containing SQL metacharacters or exceeding standard length limits.

# Example NGINX rule to block suspicious signup payloads
location = /userSignup.php {
    if ($request_method = POST) {
        if ($request_body ~* "(union|select|sleep\(|--|';)") {
            return 403;
        }
    }
    proxy_pass http://meddream_backend;
}