ZDI-22-955: Sante PACS Server SQL Injection Authentication Bypass Vulnerability
This vulnerability allows remote attackers to bypass authentication on affected installations of Sante PACS Server. Authentication is not required to exploit this vulnerability. The specific flaw exists within the processing of calls to the login endpoint. When parsing the username element, the process does not properly validate a user-supplied string before using it to construct SQL queries. An attacker can leverage this vulnerability to bypass authentication on the system.
Affected Software
Event History
Frequently Asked Questions
What is the severity of ZDI-22-955?
ZDI-22-955 is a critical vulnerability allowing remote attackers to bypass authentication.
How do I fix ZDI-22-955?
To fix ZDI-22-955, it is recommended to apply the latest security patches provided by Sante for the PACS Server.
What software is affected by ZDI-22-955?
ZDI-22-955 affects Sante PACS Server installations.
Can ZDI-22-955 be exploited without authentication?
Yes, ZDI-22-955 allows exploitation without requiring authentication from the attacker.
What is the impact of ZDI-22-955 on system security?
The vulnerability can lead to unauthorized access and potential compromise of sensitive data on the affected system.