Exploitation Summary
CVE-2018-25124 has been observed exploited in the wild (reported by VulnCheck KEV). EIP tracks 1 public exploit from researchers including Carlos Avila.
AI-analyzed exploit summary This exploit demonstrates a directory traversal vulnerability in PACSOne Server 6.6.2's DICOM Web Viewer component. The 'path' parameter in nocache.php is vulnerable to local file inclusion, allowing attackers to read arbitrary files accessible to the web user without authentication.
Description
PacsOne Server version 6.6.2 (prior versions are likely affected) contains a directory traversal vulnerability within the web-based DICOM viewer component. Successful exploitation allows a remote unauthenticated attacker to read arbitrary files via the 'nocache.php' endpoint with a crafted 'path' parameter. Exploitation evidence was observed by the Shadowserver Foundation on 2025-02-02 UTC.
Exploits (1)
This exploit demonstrates a directory traversal vulnerability in PACSOne Server 6.6.2's DICOM Web Viewer component. The 'path' parameter in nocache.php is vulnerable to local file inclusion, allowing attackers to read arbitrary files accessible to the web user without authentication.
References (3)
Scores
CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:N/VA:N/SC:N/SI:N/SA:N