Sante PACS Server PG Patient Query SQL Injection Remote Code Execution Vulnerability

CVE-2023-51637

What is CVE-2023-51637?

A SQL injection vulnerability exists in the Sante PACS Server PG, specifically within the DICOM service that operates over TCP port 11122 by default. This flaw arises when the server fails to properly validate user-supplied input in the NAME element of the PATIENT record. As a result, remote attackers can exploit this weakness to manipulate SQL queries, allowing them to execute arbitrary code in the context of the NETWORK SERVICE account. Authentication is not required for exploitation, significantly raising the risk for affected installations.

References