KiviCare < 2.3.9 - Unauthenticated SQLi
CVE-2022-0786

9.8CRITICAL

Key Information:

Vendor
Wordpress
Status
Kivicare – Clinic & Patient Management System (ehr)
Vendor
CVE Published:
13 June 2022

Summary

The KiviCare WordPress plugin before 2.3.9 does not sanitise and escape some parameters before using them in SQL statements via the ajax_post AJAX action with the get_doctor_details route, leading to SQL Injections exploitable by unauthenticated users

Affected Version(s)

KiviCare – Clinic & Patient Management System (EHR) 2.3.9

References

https://wpscan.com/vulnerability/53f493e9-273b-4349-8a59-...
x_refsource_MISC

EPSS Score

6% chance of being exploited in the next 30 days.

CVSS V3.1

Score:
9.8
Severity:
CRITICAL
Confidentiality:
High
Integrity:
High
Availability:
High
Attack Vector:
Network
Attack Complexity:
Low
Privileges Required:
None
User Interaction:
None
Scope:
Unchanged

Timeline

  • Vulnerability published

  • Vulnerability Reserved

Credit

cydave
.