CVE-2024-26262: Uniweb/SoliPACS SQLi Vulnerability

CVE-2024-26262 Overview

CVE-2024-26262 is a SQL injection vulnerability in the EBM Technologies Uniweb/SoliPACS WebServer. The query functionality fails to properly restrict user input, allowing authenticated attackers to inject arbitrary SQL commands. Successful exploitation permits reading, modifying, and deleting database records, as well as executing operating system commands through the database engine. Attackers can also abuse the dbo privilege in the underlying database to escalate their access to administrator level. The flaw is tracked under CWE-89 and is exploitable remotely over the network with only regular user credentials required.

Critical Impact
Authenticated remote attackers can execute SQL commands, run operating system commands, and escalate to administrator by abusing database dbo privileges.

Affected Products

EBM Technologies Uniweb WebServer
EBM Technologies SoliPACS WebServer
Deployments exposing the query functionality to authenticated users

Discovery Timeline

2024-02-15 - CVE-2024-26262 published to NVD
2026-06-17 - Last updated in NVD database

Technical Details for CVE-2024-26262

Vulnerability Analysis

The vulnerability resides in the query functionality of the Uniweb/SoliPACS WebServer. User-supplied parameters are concatenated into SQL statements without proper sanitization or parameterization. An attacker holding regular user credentials can submit crafted input that alters the intended query structure. This yields direct read, modify, and delete access to database contents. Because the database session runs with dbo privileges, attackers can invoke stored procedures such as xp_cmdshell on Microsoft SQL Server backends to execute operating system commands. The exploitation path also enables privilege escalation from a low-privileged application user to a full application administrator by manipulating authorization records or credential tables.

Root Cause

The root cause is improper neutralization of special elements used in SQL commands [CWE-89]. The WebServer builds SQL queries via string concatenation rather than using prepared statements or parameterized queries. No allowlist-based validation is applied to user input before it reaches the database driver.

Attack Vector

Exploitation requires network access to the WebServer and valid credentials at the regular user tier. The attacker sends crafted HTTP requests to the query endpoints, injecting SQL syntax into parameters that feed backend queries. No user interaction is required beyond the attacker's own authenticated session. The vulnerability mechanism and vendor guidance are documented in the Taiwan Computer Emergency Response Team Advisory.

Detection Methods for CVE-2024-26262

Indicators of Compromise

HTTP requests to Uniweb/SoliPACS query endpoints containing SQL metacharacters such as ', --, ;, UNION SELECT, or CONVERT(.
Database logs showing execution of xp_cmdshell, sp_OACreate, or other command-execution stored procedures initiated by the WebServer service account.
Unexpected dbo-level operations, schema changes, or new administrator accounts created inside the application database.

Detection Strategies

Deploy WAF or reverse-proxy rules that flag SQL keywords and tautologies (OR 1=1, WAITFOR DELAY) in Uniweb/SoliPACS request parameters.
Enable SQL Server auditing on the backend database to log all statements originating from the WebServer service account and alert on DDL or xp_cmdshell usage.
Correlate authenticated regular-user sessions with high-volume or high-error-rate query traffic, which often indicates injection probing.

Monitoring Recommendations

Continuously monitor process creation on the database host for child processes of sqlservr.exe, especially cmd.exe and powershell.exe.
Alert on new logins to the application with administrator privileges shortly after regular-user activity from the same source address.
Ingest WebServer and database logs into a centralized analytics platform to enable retrospective hunting for injection patterns.

How to Mitigate CVE-2024-26262

Immediate Actions Required

Contact EBM Technologies to obtain and apply the fixed release of Uniweb/SoliPACS WebServer as referenced in the TWCERT advisory.
Restrict network access to the WebServer to trusted clinical networks and administrative jump hosts only.
Rotate credentials for all Uniweb/SoliPACS users and audit the application database for unauthorized accounts or schema modifications.

Patch Information

EBM Technologies has published remediation guidance through the Taiwan Computer Emergency Response Team. Administrators should follow the vendor-supplied upgrade instructions in the TWCERT advisory and confirm the deployed build after patching. No public exploit is currently listed, and the vulnerability is not in the CISA KEV catalog.

Workarounds

Reduce the privileges of the database account used by the WebServer so it no longer holds the dbo role; grant only the specific tables and procedures required.
Disable xp_cmdshell and other command-execution surfaces on the backend SQL Server instance until patching is complete.
Place the WebServer behind a web application firewall configured with SQL injection signatures tuned for the Uniweb/SoliPACS query endpoints.

bash

# Configuration example: disable xp_cmdshell on Microsoft SQL Server
EXEC sp_configure 'show advanced options', 1;
RECONFIGURE;
EXEC sp_configure 'xp_cmdshell', 0;
RECONFIGURE;