Executive brief
OpenClinic GA, an open-source hospital information management system, is vulnerable to a security flaw in its medical image upload feature. By tricking an authorized user into uploading a specially crafted DICOM image file, an attacker can execute malicious scripts in the user's browser. This could allow the attacker to steal session information, perform actions on behalf of hospital staff, or potentially gain further control over the system's configuration.
Technical details
A reflected cross-site scripting (XSS) vulnerability exists in OpenClinic GA versions up to and including 5.351.19. The vulnerability is located in the DICOM image upload handler, specifically within `web/archiving/uploadfiles.jsp` (or `uploadfiles_jsp.java` in older versions). The application extracts metadata from uploaded DICOM files using the `DicomObject` class but fails to sanitize fields such as `StudyDescription` before reflecting them in the user interface (e.g., `popup.jsp`). An attacker can craft a DICOM file containing a JavaScript payload in these metadata tags. When an authenticated user uploads this file, the payload executes in their browser context, which can be further leveraged to modify system configurations or achieve remote code execution (RCE).
Affected products
- Post-Factum BV OpenClinic GA <= 5.351.19
Timeline
- 2026-06-09: advisory: Vulnerability disclosed by VulnCheck and researcher partywave
- 2026-06-09: disclosed