CVE-2023-51637: Sante PACS Server PG Patient Query SQL Injection Remote Code Execution Vulnerability
Sante PACS Server PG Patient Query SQL Injection Remote Code Execution Vulnerability. This vulnerability allows remote attackers to execute arbitrary code on affected installations of Sante PACS Server PG. Authentication is not required to exploit this vulnerability.
The specific flaw exists within the implementation of the DICOM service, which listens on TCP port 11122 by default. When parsing the NAME element of the PATIENT record, the process does not properly validate a user-supplied string before using it to construct SQL queries. An attacker can leverage this vulnerability to execute code in the context of NETWORK SERVICE. Was ZDI-CAN-21579.
Affected Software
Event History
Frequently Asked Questions
What is the severity of CVE-2023-51637?
CVE-2023-51637 has been rated as a critical vulnerability due to its potential for remote code execution.
How do I fix CVE-2023-51637?
To fix CVE-2023-51637, users should update Sante PACS Server PG to the latest version that patches this vulnerability.
What does CVE-2023-51637 exploit?
CVE-2023-51637 exploits a SQL injection vulnerability that allows remote attackers to execute arbitrary code.
Is authentication required to exploit CVE-2023-51637?
No, authentication is not required to exploit CVE-2023-51637, making it easier for attackers to target vulnerable systems.
Which software is affected by CVE-2023-51637?
CVE-2023-51637 affects the Sante PACS Server PG software.