Maciej Kazulak

**Name of the Vulnerable Software and Affected Versions** CGM CLININET (affected versions not specified) **Description** The issue allows an attacker to bypass authentication and gain access to any active user account in CGM CLININET by providing only the `username`. A session ID is sufficient for session takeover, granting access to the system with the privileges of the targeted user. **Recommendations** At the moment, there is no information about a newer version that contains a fix for this vulnerability.

**Name of the Vulnerable Software and Affected Versions** CGM CLININET (affected versions not specified) **Description** The application suffers from insufficient input normalization in several API endpoints, leading to potential code injection. Specifically, the parameters passed to the following endpoints are not adequately sanitized: '/cgi-bin/CliniNET.prd/utils/usrlogstat simple.pl', '/cgi-bin/CliniNET.prd/utils/usrlogstat.pl', '/cgi-bin/CliniNET.prd/utils/userlogstat2.pl', and '/cgi-bin/CliniNET.prd/utils/dblogstat.pl'. This allows for the execution of arbitrary code through crafted input. **Recommendations** At the moment, there is no information about a newer version that contains a fix for this vulnerability.

**Name of the Vulnerable Software and Affected Versions** The product name cannot be determined. (affected versions not specified) **Description** The `validateOrgUnit` function within the "CheckUnitCodeAndKey.pl" service is susceptible to SQL injection. The service is accessible via “https://t.co/CNKLxQieDl” and “https://t.co/kFecmEiCTo”. The `validateOrgUnit` function is the specific component at risk. SQL injection occurs when malicious SQL code is inserted into an entry field for execution. This can allow attackers to bypass security measures and gain unauthorized access to sensitive data. **Recommendations** At the moment, there is no information about a newer version that contains a fix for this vulnerability.

**Name of the Vulnerable Software and Affected Versions** CGM NETRAAD versions prior to 7.9.0 **Description** A SQL Injection issue exists in the "imageserver" module when processing C-FIND queries. This affects CGM NETRAAD software and potentially allows an attacker connected to a PACS system to gain access to the database, including data processed by GCM CLININET software. The issue is present when processing C-FIND queries via the `imageserver` module. The API endpoint involved is not specified. The vulnerable parameter is not specified. **Recommendations** Update CGM NETRAAD to version 7.9.0 or later.

**Name of the Vulnerable Software and Affected Versions** CGM CLININET system (affected versions not specified) **Description** The CGM CLININET system uses smart card authentication, but authentication happens locally on the client device. Instead of verifying the smart card and private key, only the certificate number is used for access verification. This means that possessing the certificate number is enough to authenticate, even without the smart card or the correct private key. **Recommendations** At the moment, there is no information about a newer version that contains a fix for this vulnerability.

**Name of the Vulnerable Software and Affected Versions** Asseco InfoMedica versions prior to 4.50.1 Asseco InfoMedica versions prior to 5.38.0 **Description** Asseco InfoMedica stores user passwords in an encoded format within a database. An attacker with access to these encoded passwords can decode them using an algorithm present in the client-side software. **Recommendations** Update to version 4.50.1 or later. Update to version 5.38.0 or later.

**Name of the Vulnerable Software and Affected Versions** Asseco InfoMedica versions prior to 4.50.1 Asseco InfoMedica versions prior to 5.38.0 **Description** Asseco InfoMedica is a solution for managing administrative and medical tasks in the healthcare sector. A user with low privileges can obtain encoded passwords for all accounts, including those with administrative privileges, due to insufficient access control granularity. Exploiting this issue, in combination with another issue, can lead to privilege escalation. **Recommendations** Update to version 4.50.1 or later. Update to version 5.38.0 or later.

Name of the Vulnerable Software and Affected Versions: (affected versions not specified) Description: The `serverConfig` API endpoint returns the module configuration, including credentials, without requiring authentication. Recommendations: At the moment, there is no information about a newer version that contains a fix for this vulnerability.

Name of the Vulnerable Software and Affected Versions: The product name cannot be determined. (affected versions not specified) Description: The `system` function is susceptible to accepting untrusted input from a user. When the `EnableJSCaching` option is enabled, it becomes possible to execute arbitrary code through the `Module` parameter. Recommendations: At the moment, there is no information about a newer version that contains a fix for this vulnerability.

Name of the Vulnerable Software and Affected Versions: versions prior to 2025-30056 Description: The `RunCommand` function accepts any parameter, which is then passed for execution in the shell, allowing an attacker to execute arbitrary code on the system. Recommendations: At the moment, there is no information about a newer version that contains a fix for this vulnerability.

Name of the Vulnerable Software and Affected Versions: UHCRTFDoc (affected versions not specified) Description: The `filename` parameter in UHCRTFDoc can be exploited to execute arbitrary code through command injection into the `system()` function call within the `ConvertToPDF` function. Recommendations: At the moment, there is no information about a newer version that contains a fix for this vulnerability.

Name of the Vulnerable Software and Affected Versions: PatientService.pl (affected versions not specified) Description: The `getPatientIdentifier` function within the PatientService.pl service is susceptible to SQL injection due to improper handling of the `pesel` parameter. Recommendations: As a temporary workaround, consider restricting access to the `getPatientIdentifier` function until a fix is available. Sanitize the `pesel` parameter before using it in SQL queries.

Name of the Vulnerable Software and Affected Versions: Print.pl (affected versions not specified) Description: The `uhcPrintServerPrint` function allows execution of arbitrary code via the `CopyCounter` parameter. Recommendations: At the moment, there is no information about a newer version that contains a fix for this vulnerability. As a temporary workaround, consider restricting access to the `uhcPrintServerPrint` function until a patch is available. Avoid using the `CopyCounter` parameter in the affected function until the issue is resolved.

Name of the Vulnerable Software and Affected Versions: ReturnUserUnitsXML.pl (affected versions not specified) Description: The `getUserInfo` function within the ReturnUserUnitsXML.pl service is susceptible to SQL injection via the `UserID` parameter. Recommendations: As a temporary workaround, consider restricting access to the `getUserInfo` function until a fix is available. Sanitize the `UserID` parameter to prevent SQL injection attacks.

Name of the Vulnerable Software and Affected Versions: utils/Reporter/OpenReportWindow.pl (affected versions not specified) Description: The “utils/Reporter/OpenReportWindow.pl” service contains an SQL injection issue through the `UserID` parameter. Recommendations: At the moment, there is no information about a newer version that contains a fix for this vulnerability.

Name of the Vulnerable Software and Affected Versions: The product name cannot be determined. (affected versions not specified) Description: The configuration file containing database logins and passwords is readable by any local user. Recommendations: At the moment, there is no information about a newer version that contains a fix for this vulnerability.

Name of the Vulnerable Software and Affected Versions: versions prior to 2.3 Description: An insufficiently secured internal function allows session generation for arbitrary users. The `decodeParam` function checks the JWT but does not verify which signing algorithm was used. An attacker can use the `ex:action` parameter in the `VerifyUserByThrustedService` function to generate a session for any user. Recommendations: Update to a version prior to 2.3. As a temporary workaround, consider restricting the use of the `VerifyUserByThrustedService` function until a patch is available. Avoid using the `ex:action` parameter until the issue is resolved.

Name of the Vulnerable Software and Affected Versions: PrepareCDExportJSON.pl (affected versions not specified) Description: The `getPerfServiceIds` function within the PrepareCDExportJSON.pl service is susceptible to SQL injection. This allows for potential manipulation of database queries through crafted input. Recommendations: As a temporary workaround, consider restricting access to the `getPerfServiceIds` function until a fix is available.

Name of the Vulnerable Software and Affected Versions: Oddział module (affected versions not specified) Description: A stored cross-site scripting (XSS) issue exists in the “Oddział” (Ward) module, specifically within the death diagnosis description field. Successful exploitation allows attackers to execute arbitrary JavaScript code. This could lead to session hijacking of other users and potential privilege escalation, possibly up to full administrative rights. Recommendations: At the moment, there is no information about a newer version that contains a fix for this vulnerability.

Name of the Vulnerable Software and Affected Versions: (affected versions not specified) Description: The system exposes several endpoints, typically including `/int/` in their path, that should be restricted to internal services but are publicly accessible without authentication to any host able to reach the application server on port 443/tcp. Recommendations: Restrict access to internal services to prevent unauthorized access via the exposed endpoints.