CVE-2022-0786 KiviCare < 2.3.9 - Unauthenticated SQLi

2022-06-1312:41:32

CWE-89

WPScan

www.cve.org

0.04 Low

EPSS

Percentile

92.1%

JSON

The KiviCare WordPress plugin before 2.3.9 does not sanitise and escape some parameters before using them in SQL statements via the ajax_post AJAX action with the get_doctor_details route, leading to SQL Injections exploitable by unauthenticated users

CNA Affected

[
  {
    "product": "KiviCare – Clinic & Patient Management System (EHR)",
    "vendor": "Unknown",
    "versions": [
      {
        "lessThan": "2.3.9",
        "status": "affected",
        "version": "2.3.9",
        "versionType": "custom"
      }
    ]
  }
]

References

wpscan.com/vulnerability/53f493e9-273b-4349-8a59-f2207e8f8f30

0.04 Low

EPSS

Percentile

92.1%

JSON

Related for CVELIST:CVE-2022-0786