CVE-2022-2272

Deeper analysis

This vulnerability is an unauthenticated SQL injection flaw, tracked as CVE-2022-2272 and originally reported as ZDI-CAN-17331, that affects Sante PACS Server version 3.0.4. The issue resides in the login endpoint where the username value supplied by a client is concatenated into SQL queries without adequate validation or parameterization, allowing an attacker to alter query logic.

Remote attackers can exploit the flaw over the network without any credentials or user interaction. Successful exploitation grants full bypass of authentication controls, enabling the attacker to access the system with the privileges of an authenticated user and potentially achieve arbitrary data access or modification consistent with the CVSS 9.8 rating and CWE-89 classification.

The associated Zero Day Initiative advisory ZDI-22-955 documents the issue but does not detail specific patches or configuration workarounds in the supplied references. The EPSS score has remained flat at its peak value of 0.2466 with no material increase observed after disclosure.