CVE-2025-10350

Executive Summary

CVE-2025-10350 is a critical SQL Injection vulnerability discovered in the "imageserver" module of CGM NETRAAD software. The flaw allows an attacker connected to the PACS (Picture Archiving and Communication System) to inject malicious SQL queries via C-FIND requests, leading to unauthorized access to the database. This includes sensitive data processed by the GCM CLININET software. The vulnerability affects all versions of CGM NETRAAD with the imageserver module before 7.9.0. No public proof-of-concept (PoC) or exploit code has been released at this time, and the vendor has not yet issued a patch, though an upgrade path exists.

CVSS Breakdown & Threat Level

The CVSS score is currently listed as 0.0, indicating that the NVD has not yet assigned a score. However, based on the nature of the vulnerability (SQL Injection in a medical imaging system), the likely CVSS v3.1 vector would be:

• Attack Vector (AV): Network (N) – The attacker can exploit this remotely over the network.
• Attack Complexity (AC): Low (L) – No special conditions are required.
• Privileges Required (PR): None (N) – No authentication needed.
• User Interaction (UI): None (N) – No user action required.
• Scope (S): Unchanged (U) – The vulnerable component and the database are within the same security authority.
• Confidentiality (C): High (H) – Full database access, including sensitive patient data.
• Integrity (I): High (H) – Data can be modified or deleted.
• Availability (A): High (H) – Database can be disrupted or destroyed.

Estimated CVSS Score: 9.8 (Critical)

Threat Level: Critical. Exploitation could lead to complete compromise of the PACS database, exposing protected health information (PHI) and potentially disrupting clinical operations.

Deep Dive & Mechanics

The vulnerability resides in the imageserver module of CGM NETRAAD, which handles DICOM C-FIND queries. C-FIND is a standard DICOM service used to search for studies, series, or instances within a PACS. The imageserver module fails to properly sanitize user-supplied input within the C-FIND request parameters. An attacker can craft a malicious C-FIND query containing SQL injection payloads in fields such as PatientName, StudyDescription, or AccessionNumber.

When the imageserver processes the query, it constructs a SQL statement by concatenating the attacker-controlled input without parameterization or escaping. This allows the attacker to break out of the intended SQL syntax and execute arbitrary commands on the underlying database (likely a relational database like PostgreSQL or Oracle). The database contains all data processed by GCM CLININET, including patient demographics, clinical reports, and imaging metadata.

Attack Flow:

1. The attacker connects to the PACS network (either internally or via a VPN/remote access).
2. The attacker sends a crafted DICOM C-FIND request to the imageserver on the default DICOM port (e.g., 11112).
3. The request includes SQL injection payloads in one or more query fields.
4. The imageserver constructs a SQL query using the unsanitized input.
5. The database executes the malicious SQL, returning data or performing actions as directed.
6. The attacker receives the results via the C-FIND response or through out-of-band channels (e.g., DNS exfiltration).

Vulnerable vs. Patched Code

Vulnerable Code (Conceptual):

# Vulnerable: Direct string concatenation
def handle_c_find(request):
    patient_name = request.get("PatientName")
    query = f"SELECT * FROM studies WHERE patient_name = '{patient_name}'"
    cursor.execute(query)
    return cursor.fetchall()

Patched Code (Conceptual):

# Patched: Parameterized query
def handle_c_find(request):
    patient_name = request.get("PatientName")
    query = "SELECT * FROM studies WHERE patient_name = ?"
    cursor.execute(query, (patient_name,))
    return cursor.fetchall()

The patched version uses parameterized queries (prepared statements) to ensure that user input is treated as data, not executable code. This prevents SQL injection regardless of the input content.

Exploitation & Lab Setup

Red Team

Lab Environment:

• CGM NETRAAD with imageserver module (version < 7.9.0) installed on a Windows Server 2019 VM.
• DICOM toolkit (e.g., dcmtk or fo-dicom) to craft C-FIND requests.
• SQL injection testing tools (e.g., sqlmap with DICOM support, or manual payloads).

Exploitation Steps:

1. Reconnaissance: Scan the network for the DICOM port (default 11112) using nmap -p 11112 <target>.
2. Craft Malicious C-FIND: Use a DICOM client to send a C-FIND request with a SQL injection payload in the PatientName field. Example payload:

   PatientName: ' OR '1'='1' --
   

3. Extract Data: Use UNION-based SQL injection to retrieve data from other tables. Example:

   PatientName: ' UNION SELECT username, password FROM users --
   

4. Automate with sqlmap: If the DICOM protocol is supported, use sqlmap with a custom request file. Otherwise, manually craft requests.

Note: No public exploit code is available. The above is a conceptual guide.

Blue Team

Detection & Response:

• Monitor DICOM C-FIND requests for anomalous patterns, especially unusual characters in query fields (e.g., single quotes, SQL keywords).
• Enable logging on the imageserver to capture all C-FIND queries and their parameters.
• Deploy a Web Application Firewall (WAF) or database firewall that can inspect DICOM traffic for SQL injection signatures.
• Implement network segmentation to limit PACS access to authorized systems only.
• Use an IDS/IPS with custom rules to detect SQL injection attempts in DICOM traffic.

Indicators of Compromise (IOCs)

• Network IOCs:

  • Unusual DICOM C-FIND requests containing SQL keywords (e.g., SELECT, UNION, OR, --, ').
  • Outbound database connections from the imageserver to unexpected IPs (data exfiltration).
  • DNS queries for unusual domains (if using out-of-band exfiltration).

• Host IOCs:

  • Unexpected database queries in the database logs (e.g., SELECT * FROM information_schema.tables).
  • Modified or deleted records in the PACS database.
  • Unusual processes running on the imageserver host (e.g., cmd.exe or powershell.exe spawned by the DICOM service).

• File IOCs:

  • Temporary files created by SQL injection tools (e.g., sqlmap output files).
  • Log files containing SQL injection payloads.

Detection Engineering

YARA Rule

rule CVE_2025_10350_SQLi_C_FIND {
    meta:
        description = "Detects SQL injection attempts in DICOM C-FIND requests targeting CGM NETRAAD imageserver"
        author = "Valters IT"
        date = "2025-04-10"
        cve = "CVE-2025-10350"
    strings:
        $sql_injection = /['\"]\s*(OR|AND|UNION|SELECT|INSERT|UPDATE|DELETE|DROP|EXEC|xp_cmdshell|sp_executesql)\s/i
        $dicom_cfind = /C-FIND|C_FIND|CFIND/i
    condition:
        $dicom_cfind and $sql_injection
}

Sigma Rule

title: CVE-2025-10350 SQL Injection in CGM NETRAAD C-FIND
id: 8a4b3c2d-1e5f-4a7b-9c8d-0e1f2a3b4c5d
status: experimental
description: Detects SQL injection attempts in DICOM C-FIND requests
author: Valters IT
date: 2025-04-10
tags:
    - attack.t1190
    - cve.2025.10350
logsource:
    category: application
    product: cgm_netraad
detection:
    selection:
        EventID: 4624  # Example: DICOM request logged
        RequestType: 'C-FIND'
        Parameters|contains:
            - "'"
            - "OR"
            - "AND"
            - "UNION"
            - "SELECT"
            - "DROP"
    condition: selection
falsepositives:
    - Legitimate use of special characters in patient names (rare)
level: high

Suricata Rule

alert tcp $EXTERNAL_NET any -> $HOME_NET 11112 (msg:"CVE-2025-10350 SQL Injection in CGM NETRAAD C-FIND"; flow:to_server,established; content:"C-FIND"; nocase; content:"'"; distance:0; within:100; pcre:"/(\x27|\x22)\s*(OR|AND|UNION|SELECT|INSERT|UPDATE|DELETE|DROP|EXEC|xp_cmdshell|sp_executesql)/i"; sid:1000001; rev:1;)

Remediation & Mitigation

Immediate Actions:

1. Upgrade: Update CGM NETRAAD to version 7.9.0 or later, which contains the fix for this vulnerability.
2. Workaround: If immediate upgrade is not possible, restrict network access to the imageserver module to only trusted PACS clients using firewall rules or IP whitelisting.
3. Monitor: Enable detailed logging on the imageserver and database to detect any exploitation attempts.

Long-Term Measures:

• Implement input validation and parameterized queries for all DICOM services.
• Conduct regular security assessments of medical devices and software.
• Ensure that the PACS network is segmented from the corporate network and the internet.
• Deploy a database activity monitoring (DAM) solution to detect anomalous queries.

Patch Status: The vendor has released version 7.9.0 to address this issue. All users are strongly advised to upgrade immediately.

Valters IT