KiviCare – Clinic & Patient Management System (EHR) <= 3.6.7 - Authenticated (Doctor+) SQL Injection via 'u_id' Parameter

Vulnerability

The KiviCare – Clinic & Patient Management System (EHR) plugin for WordPress is vulnerable to SQL Injection in all versions up to and including 3.6.7. The flaw resides in the handling of the u_id parameter, where insufficient escaping on user-supplied input and lack of prepared statements allow an attacker to inject arbitrary SQL queries into existing database queries [1].

Exploitation

An attacker must be authenticated with at least doctor-level access to the WordPress site. By crafting a malicious u_id parameter in a request to a vulnerable endpoint, the attacker can append additional SQL statements to the original query. No other special network position or user interaction is required beyond the authenticated session.

Impact

Successful exploitation enables the attacker to extract sensitive information from the WordPress database, including patient records, user credentials, and other confidential data managed by the plugin. The attack does not grant code execution or file modification but leads to significant information disclosure.

Mitigation

The vendor has released version 4.4.0 of the plugin, which is the latest version available on the WordPress plugin repository [1]. Users should update to version 4.4.0 or later to remediate the vulnerability. No official workaround has been published, and the plugin is not listed on the CISA KEV catalog.