CVE-2024-11728
📋 TL;DR
This SQL injection vulnerability in the KiviCare WordPress plugin allows unauthenticated attackers to execute arbitrary SQL queries through the 'visit_type[service_id]' parameter. Attackers can extract sensitive data like patient records, user credentials, and other database information. All WordPress sites using KiviCare plugin versions up to 3.6.4 are affected.
💻 Affected Systems
- KiviCare – Clinic & Patient Management System (EHR) WordPress plugin
📦 What is this software?
Kivicare by Iqonic
⚠️ Risk & Real-World Impact
Worst Case
Complete database compromise including patient health records, user credentials, financial data, and potential full site takeover through privilege escalation.
Likely Case
Extraction of sensitive patient and user data, potentially leading to data breaches and regulatory violations.
If Mitigated
Limited information disclosure if database permissions are properly restricted and input validation is implemented elsewhere.
🎯 Exploit Status
SQL injection via AJAX endpoint makes exploitation straightforward for attackers with basic SQL knowledge.
🛠️ Fix & Mitigation
✅ Official Fix
Patch Version: 3.6.5
Vendor Advisory: https://plugins.trac.wordpress.org/changeset/3201428/kivicare-clinic-management-system/trunk/app/controllers/KCTaxController.php
Restart Required: No
Instructions:
1. Log into WordPress admin panel. 2. Navigate to Plugins → Installed Plugins. 3. Find KiviCare plugin and click 'Update Now'. 4. Verify version shows 3.6.5 or higher.
🔧 Temporary Workarounds
Temporary Plugin Deactivation
allDisable the KiviCare plugin until patched
wp plugin deactivate kivicare-clinic-management-system
Web Application Firewall Rule
allBlock requests to the vulnerable AJAX endpoint
Location: /wp-admin/admin-ajax.php?action=tax_calculated_data
Block pattern: visit_type\[service_id\] with SQL injection patterns
🧯 If You Can't Patch
- Implement strict input validation and parameterized queries at application level
- Restrict database user permissions to minimum required access
🔍 How to Verify
Check if Vulnerable:
Check WordPress admin panel → Plugins → KiviCare version. If version is 3.6.4 or lower, system is vulnerable.Check Version:
wp plugin get kivicare-clinic-management-system --field=versionVerify Fix Applied:
Verify KiviCare plugin version shows 3.6.5 or higher in WordPress admin.📡 Detection & Monitoring
Log Indicators:
- Unusual SQL error messages in WordPress debug logs
- Multiple POST requests to /wp-admin/admin-ajax.php with tax_calculated_data action
- SQL keywords (SELECT, UNION, etc.) in visit_type[service_id] parameter
Network Indicators:
- POST requests containing SQL injection patterns in parameters
- Unusual database query patterns from web server
SIEM Query:
source="wordpress.log" AND "admin-ajax.php" AND "tax_calculated_data" AND ("SELECT" OR "UNION" OR "FROM" OR "WHERE")