Unauthenticated SQL injection into an imaging database, base score 9.8

MedDevice Cyber Staff · Dec 6 · 3 min read · Via Siemens Healthineers

Siemens Healthineers SHSA-160244 hit syngo.plaza VB30E before VB30E_HF05. CVE-2024-52335, unauthenticated SQL injection, base score 9.8. No auth, no user interaction.

SQL injection arises when an application assembles a database query by pasting user-supplied text straight into the command instead of passing it as a separate parameter. The database cannot distinguish the developer's intended query from an attacker's added clause, so input crafted to break out of the expected field is executed as instructions against the data. When the flaw needs no login, any host able to reach the interface can send that input.

SQL injection in 2024 on an imaging platform is a hard thing to read. It is the oldest bug in the web-application book, and it still puts a database of medical imaging in an attacker hands with one crafted request. Pair it with the later syngo.plaza password advisory and you have two findings in the same product line, both about the boundary between the app and its database.

An imaging platform's database is the index to studies, reports and the identifiers that link them to patients. Arbitrary queries against it mean records can be read, altered or removed, and the integrity of what a clinician later retrieves can no longer be assumed. A compromise at the data layer is quieter than a crash, and it can be harder to detect once the request has been served.

The persistence of this weakness in clinical software owes much to how long these platforms stay in service. Code authored in an earlier era survives version after version, and query-building habits that predate modern safeguards remain inside products still deployed across radiology departments. A finding in one release often points to a pattern woven through the wider codebase rather than to a single stray line.

Fixed in VB30E_HF05. Parameterize every query. There is no clever exception, no performance argument, no legacy reason good enough to concatenate user input into SQL, and there has not been for twenty years.

Remediation Desk

For ProvidersOperators, hospitals, and clinical engineering

syngo.plaza VB30E failed to sanitize input before the SQL server (Siemens SHSA-160244, base score 9.8), letting an unauthenticated network attacker run arbitrary SQL and compromise the whole database. Apply the Siemens fix and, as a matter of design, parameterize every query.

Apply the Siemens fix. Update syngo.plaza to the remediated build from SHSA-160244.
Parameterize every query. Use parameterized statements so input is never concatenated into SQL; this closes the class, not just the instance.
Segment the database. Keep the imaging database off any network path that does not need it so an unauthenticated attacker cannot reach it.

For Device ManufacturersAm I affected, and how to fix the class

Am I affected?

This class applies to devices with the properties below. Check them against your product to gauge exposure.

Required

app_database data_phi

Contributing

net_wired net_remote_access app_web_ui app_user_accounts use_hospital_net parse_image sys_ots_software

EMB3D

PID-311

Fix the class in your product

Input reaches the database as query text. As the maker, parameterize every query so input is never concatenated into SQL, run on a least-privilege database account, and enforce it with a static-analysis gate so a concatenated query fails the build.

Parameterize every query. No exceptions for internal or trusted callers; bind inputs, never build statement text from them.
Least-privilege the database role. The app account cannot alter schema or reach unrelated tables.
Gate it in CI/CD. Static analysis fails a build that concatenates a query.

Mapped EMB3D mitigations

Questions & Answers

What is CVE-2024-52335 in Siemens syngo.plaza?

An unauthenticated SQL injection in syngo.plaza VB30E, base score 9.8, published as Siemens Healthineers advisory SHSA-160244. One crafted request reaches the imaging database with no login and no user interaction.

Which version fixes the syngo.plaza SQL injection?

VB30E_HF05. Versions before that hotfix are affected and should be updated.

← Back to Vulnerabilities