This is a summary of the AI-generated 10-question deep analysis. The full version (longer answers, follow-up Q&A, related CVEs) requires login. Read the full analysis β
Q1What is this vulnerability? (Essence + Consequences)
π¨ **Essence**: Unauthenticated SQL Injection (SQLi) in KiviCare plugin. π₯ **Consequences**: Attackers can read, modify, or delete database contents. Critical risk to patient data and system integrity.
Q2Root Cause? (CWE/Flaw)
π‘οΈ **Root Cause**: CWE-89 (SQL Injection). π **Flaw**: The `tax_calculated_data` function fails to sanitize the `visit_type[service_id]` parameter. Lack of prepared statements allows raw SQL execution.
Q3Who is affected? (Versions/Components)
π₯ **Affected**: WordPress Plugin: **KiviCare β Clinic & Patient Management System (EHR)**. π **Versions**: 3.6.4 and earlier. π’ **Vendor**: iqonicdesign.
Q4What can hackers do? (Privileges/Data)
π **Attacker Actions**: Execute arbitrary SQL queries. π **Data Access**: Extract sensitive info (user creds, patient records). π **Privileges**: Unauthenticated access means anyone can exploit it without logging in.
Q5Is exploitation threshold high? (Auth/Config)
β‘ **Threshold**: LOW. π« **Auth Required**: NONE. π **Access**: Remote/Network. π±οΈ **User Interaction**: NONE. Easy to exploit via AJAX calls.
Q6Is there a public Exp? (PoC/Wild Exploitation)
π **Exploit Available**: YES. π **PoC**: Public GitHub PoC exists (samogod/CVE-2024-11728). π€ **Automation**: Nuclei templates available for mass scanning.
Q7How to self-check? (Features/Scanning)
π **Check**: Scan for KiviCare plugin version β€ 3.6.4. π§ͺ **Test**: Send malicious payload to `tax_calculated_data` AJAX endpoint via `visit_type[service_id]`. π‘ **Tools**: Use Nuclei or manual Burp Suite requests.
Q8Is it fixed officially? (Patch/Mitigation)
π οΈ **Fix**: Update plugin to version > 3.6.4. π **Patch**: Vendor released fix in changeset 3201428. β **Status**: Official patch available.
Q9What if no patch? (Workaround)
π§ **No Patch?**: Disable the plugin immediately. π« **Block**: Restrict access to `wp-admin/admin-ajax.php` or specific AJAX endpoints. π‘οΈ **WAF**: Deploy WAF rules to block SQLi patterns in `service_id` param.
Q10Is it urgent? (Priority Suggestion)
π₯ **Urgency**: HIGH. π¨ **Priority**: Critical. β±οΈ **Reason**: Unauthenticated + SQLi + Public PoC. Patch immediately to prevent data breaches.