CVE-2018-25372

HIGH

MedDream PACS Server Premium 6.7.1.1 SQL Injection via email

Title source: cna

Exploitation Summary

EIP tracks 1 public exploit for CVE-2018-25372. PoCs published by Carlos Avila.

AI-analyzed exploit summary This exploit demonstrates a SQL injection vulnerability in MedDream PACS Server Premium 6.7.1.1 via the 'email' and 'username' parameters in the user signup functionality. The provided HTTP request and sqlmap output confirm the vulnerability and successful database enumeration.

Description

MedDream PACS Server Premium 6.7.1.1 contains an SQL injection vulnerability that allows unauthenticated attackers to execute arbitrary SQL queries by injecting malicious code through the email parameter. Attackers can submit crafted POST requests to the userSignup.php endpoint with SQL payloads in the email field to extract sensitive database information from the backend MySQL database.

Exploits (1)

exploitdb WORKING POC

by Carlos Avila · textwebappsphp

https://www.exploit-db.com/exploits/45344

View Code ZIP pw:eip

This exploit demonstrates a SQL injection vulnerability in MedDream PACS Server Premium 6.7.1.1 via the 'email' and 'username' parameters in the user signup functionality. The provided HTTP request and sqlmap output confirm the vulnerability and successful database enumeration.

Classification

Working Poc 95%

Attack Type

Sqli

Complexity

Trivial

Reliability

Reliable

Target: MedDream PACS Server Premium 6.7.1.1

No auth needed

Prerequisites: Network access to the target server · SQL injection payload

MITRE ATT&CK

T1190 - Exploit Public-Facing Application T1059 - Command and Scripting Interpreter

devstral-2 · analyzed May 25, 2026 Full analysis →

References (2)

Core 2

Core References

Exploit exploit

ExploitDB-45344

https://www.exploit-db.com/exploits/45344

Third Party Advisory third-party-advisory

VulnCheck Advisory: MedDream PACS Server Premium 6.7.1.1 SQL Injection via email

https://www.vulncheck.com/advisories/meddream-pacs-server-premium-sql-injection-via-email

Scores

CVSS v3 8.2

EPSS 0.0031

EPSS Percentile 22.0%

Attack Vector NETWORK

CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:L/A:N

CISA SSVC

Vulnrichment

Exploitation poc

Automatable yes

Technical Impact partial

Details

CWE

CWE-89

Status published

Products (1)

MedDream/PACS Server Premium 6.7.1.1

Published May 25, 2026

Tracked Since May 25, 2026