KiviCare – Clinic & Patient Management System (EHR) <= 3.6.4 - Authenticated (Subscriber+) SQL Injection

Vulnerability

The KiviCare – Clinic & Patient Management System (EHR) WordPress plugin versions up to and including 3.6.4 are vulnerable to SQL injection via the service_list[0][service_id] parameter in the get_widget_payment_options AJAX action. The plugin fails to properly escape user-supplied input and lacks sufficient preparation on the existing SQL query, allowing attackers to inject additional SQL queries [1].

Exploitation

An authenticated attacker with at least Custom-level access can exploit this vulnerability by sending a crafted AJAX request containing malicious SQL in the service_list[0][service_id] parameter. No further user interaction is required [1].

Impact

Successful exploitation allows the attacker to append arbitrary SQL queries to existing ones, potentially extracting sensitive information from the database, such as user credentials or patient data [1].

Mitigation

The vulnerability is fixed in version 4.4.0 of the plugin [1]. Users should update to the latest version immediately. No workarounds are known.