This is a summary of the AI-generated 10-question deep analysis. The full version (longer answers, follow-up Q&A, related CVEs) requires login.
Read the full analysis →
Q1What is this vulnerability? (Essence + Consequences)
🚨 **Essence**: Unauthenticated SQL Injection (SQLi) in KiviCare plugin. 💥 **Consequences**: Attackers can read, modify, or delete database contents. Critical risk to patient data and system integrity.
Q2Root Cause? (CWE/Flaw)
🛡️ **Root Cause**: CWE-89 (SQL Injection). 🐛 **Flaw**: The `tax_calculated_data` function fails to sanitize the `visit_type[service_id]` parameter. Lack of prepared statements allows raw SQL execution.
Q3Who is affected? (Versions/Components)
🏥 **Affected**: WordPress Plugin: **KiviCare – Clinic & Patient Management System (EHR)**. 📉 **Versions**: 3.6.4 and earlier. 🏢 **Vendor**: iqonicdesign.
Q4What can hackers do? (Privileges/Data)
💀 **Attacker Actions**: Execute arbitrary SQL queries. 📂 **Data Access**: Extract sensitive info (user creds, patient records). 🔓 **Privileges**: Unauthenticated access means anyone can exploit it without logging in.
Q5Is exploitation threshold high? (Auth/Config)
⚡ **Threshold**: LOW. 🚫 **Auth Required**: NONE. 🌐 **Access**: Remote/Network. 🖱️ **User Interaction**: NONE. Easy to exploit via AJAX calls.
Q6Is there a public Exp? (PoC/Wild Exploitation)
🔓 **Exploit Available**: YES. 📂 **PoC**: Public GitHub PoC exists (samogod/CVE-2024-11728). 🤖 **Automation**: Nuclei templates available for mass scanning.
Q7How to self-check? (Features/Scanning)
🔍 **Check**: Scan for KiviCare plugin version ≤ 3.6.4. 🧪 **Test**: Send malicious payload to `tax_calculated_data` AJAX endpoint via `visit_type[service_id]`. 📡 **Tools**: Use Nuclei or manual Burp Suite requests.
Q8Is it fixed officially? (Patch/Mitigation)
🛠️ **Fix**: Update plugin to version > 3.6.4. 📝 **Patch**: Vendor released fix in changeset 3201428. ✅ **Status**: Official patch available.
Q9What if no patch? (Workaround)
🚧 **No Patch?**: Disable the plugin immediately. 🚫 **Block**: Restrict access to `wp-admin/admin-ajax.php` or specific AJAX endpoints. 🛡️ **WAF**: Deploy WAF rules to block SQLi patterns in `service_id` param.
Q10Is it urgent? (Priority Suggestion)
🔥 **Urgency**: HIGH. 🚨 **Priority**: Critical. ⏱️ **Reason**: Unauthenticated + SQLi + Public PoC. Patch immediately to prevent data breaches.