CGM CLININET hit by auth bypass, SQL injection flaws
CERT Polska disclosed 8 vulnerabilities in CGM CLININET and CGM NETRAAD healthcare software, including authentication bypass, SQL injection, and insecure direct object references.
CERT Polska coordinated the disclosure of eight vulnerabilities affecting CGM CLININET and CGM NETRAAD medical software systems. The most critical flaw, CVE-2025-30035, allows complete authentication bypass in CGM CLININET by providing only a username, enabling session takeover without passwords or credentials. A second authentication weakness, CVE-2025-30042, permits access using only a certificate number, bypassing smart card verification and private key requirements.
Additional vulnerabilities include CVE-2025-10350, an SQL injection in the CGM NETRAAD imageserver module that exposes database contents including CGM CLININET data when attackers connect to PACS systems. Multiple code and SQL injection flaws exist in various CGM CLININET endpoints (CVE-2025-30044, CVE-2025-30062). Access control weaknesses allow unauthorized access to patient messages and attachments through sequential identifier manipulation (CVE-2025-58402).
The vulnerabilities also include missing security headers enabling clickjacking attacks (CVE-2025-58405, CVE-2025-58406). CGM NETRAAD versions before 7.9.0 with the imageserver module are confirmed affected. The researcher Maciej Kazulak responsibly reported five of the eight vulnerabilities through CERT Polska's coordinated disclosure process.
Mentioned in this report
Detection guidance
Possible SQL Injection Attempt Against CGM NETRAAD Imageserver Module
Detects SQL injection payload patterns in requests to the imageserver module associated with CVE-2025-10350 Auto-generated starting point — validate and tune in your environment before deploying. IOC matches can false-positive on shared infrastructure and decay as adversary infrastructure rotates.
title: Possible SQL Injection Attempt Against CGM NETRAAD Imageserver Module
id: 0ed37090-29e4-51a0-9984-30a1734419c3
status: experimental
description: Detects SQL injection payload patterns targeting the imageserver module
in CGM NETRAAD, associated with CVE-2025-10350, which exposes database contents
including CGM CLININET data.
references:
- https://cert.pl
logsource:
category: webserver
detection:
selection_path:
cs-uri-stem|contains: imageserver
selection_sqli:
cs-uri-query|contains:
- UNION SELECT
- ''' OR ''1''=''1'
- --+
- SLEEP(
- xp_cmdshell
- ''' AND ''1''=''1'
- INFORMATION_SCHEMA
condition: selection_path and selection_sqli
falsepositives:
- Security scanning or penetration testing of the imageserver endpoint
- Automated vulnerability scanners probing PACS integration modules
level: high
tags:
- attack.t1190
- attack.initial_access
author: Vorant
Authentication Request With Username Only (Possible CLININET Auth Bypass Attempt)
Detects login/session requests containing a username parameter but no password parameter, consistent with the CVE-2025-30035 authentication bypass pattern in CGM CLININET. Auto-generated starting point — validate and tune in your environment before deploying. IOC matches can false-positive on shared infrastructure and decay as adversary infrastructure rotates.
title: Authentication Request With Username Only (Possible CLININET Auth Bypass Attempt)
id: 4abef475-0914-59e8-8e0b-4ca4ec8825a2
status: experimental
description: Detects authentication or session requests to login-related endpoints
where only a username (or certificate number) parameter is supplied without an accompanying
password parameter, matching the behaviour described for CVE-2025-30035 and CVE-2025-30042
authentication bypass in CGM CLININET.
references:
- https://cert.pl
logsource:
category: webserver
detection:
selection_login_path:
cs-uri-stem|contains:
- login
- session
- auth
selection_username_param:
cs-uri-query|contains:
- username=
- certificateNumber=
- certNumber=
filter_has_password:
cs-uri-query|contains:
- password=
- passwd=
- pin=
condition: selection_login_path and selection_username_param and not filter_has_password
falsepositives:
- Password reset or username-lookup workflows that legitimately omit a password field
- SSO pre-authentication redirects that pass username before credential prompt
level: medium
tags:
- attack.t1190
- attack.initial_access
author: Vorant
Behavioural rules are generated from public reporting — validate in your environment before deploying.
Source reporting: https://cert.pl/en/posts/2026/03/CVE-2025-10350
This is the public brief
Subscribers see the full picture: extracted IOCs, ready-to-deploy detections (Sigma, Splunk, KQL, Elastic, YARA, Suricata), the entity graph, TAXII 2.1 feed and real-time alerts matched to your sectors.
Start free