MedDream PACS Server Premium 6.7.1.1 contains an unauthenticated SQL injection flaw that lets attackers craft malicious input in the email field of the userSignup.php endpoint. By sending a POST request with SQL payloads, an attacker can execute arbitrary SQL queries against the underlying MySQL database, resulting in the extraction of sensitive data such as patient records and system configuration.

The vulnerability affects MedDream PACS Server Premium, specifically version 6.7.1.1. Users running this build are susceptible to the injection attack.

The CVSS score of 8.8 classifies the flaw as a high‑severity vulnerability. The EPSS score is not provided, making the exact likelihood of exploitation uncertain, and the issue is not listed in the CISA KEV catalog. Attackers can exploit the flaw via unauthenticated HTTP POST requests to the userSignup.php endpoint, implying that the attack can be carried out over the network without prior access.