CVE-2018-25124

PacsOne Server 6.6.2 (and likely earlier) contains a directory traversal (local file inclusion) flaw in the web-based DICOM viewer. The vulnerability allows unauthenticated remote attackers to read arbitrary files via the nocache.php endpoint with a crafted path parameter. Exploitation evidence w...