CVE-2022-0786— WordPress plugin KiviCare SQL注入漏洞
Public Exploits 1
Nuclei · 1 CVE-2022-0786.yaml [template]
Possible ATT&CK Techniques 1AI
T1190 · Exploit Public-Facing Application新しい脆弱性情報の通知を購読するログインして購読
I. CVE-2022-0786の基本情報
脆弱性情報
脆弱性についてご質問がありますか？Shenlongの分析が参考になるかご確認ください！
Shenlongの10の質問を表示 ↗ 高度な大規模言語モデル技術を使用していますが、出力には不正確または古い情報が含まれる可能性があります。Shenlongはデータの正確性を確保するよう努めていますが、実際の状況に基づいて検証・判断してください。
脆弱性タイトル
KiviCare < 2.3.9 - Unauthenticated SQLi
ソース: CVE Program / CVE List V5
脆弱性説明
The KiviCare WordPress plugin before 2.3.9 does not sanitise and escape some parameters before using them in SQL statements via the ajax_post AJAX action with the get_doctor_details route, leading to SQL Injections exploitable by unauthenticated users
ソース: CVE Program / CVE List V5
CVSS情報
N/A
ソース: CVE Program / CVE List V5
脆弱性タイプ
SQL命令中使用的特殊元素转义处理不恰当(SQL注入)
ソース: CVE Program / CVE List V5
脆弱性タイトル
WordPress plugin KiviCare SQL注入漏洞
ソース: CNNVD (China National Vulnerability Database)
脆弱性説明
WordPress和WordPress plugin都是WordPress基金会的产品。WordPress是一套使用PHP语言开发的博客平台。该平台支持在PHP和MySQL的服务器上架设个人博客网站。WordPress plugin是一个应用插件。 WordPress plugin KiviCare 2.3.9之前版本存在SQL注入漏洞，该漏洞源于在通过带有 get_doctor_details 路由的 ajax_post AJAX 操作中使用某些参数之前不会对其进行清理和转义。
ソース: CNNVD (China National Vulnerability Database)
CVSS情報
N/A
ソース: CNNVD (China National Vulnerability Database)
脆弱性タイプ
N/A
ソース: CNNVD (China National Vulnerability Database)
影響を受ける製品
| ベンダー | プロダクト | 影響を受けるバージョン | CPE | 購読 |
|---|---|---|---|---|
| Unknown | KiviCare – Clinic & Patient Management System (EHR) | 2.3.9 ~ 2.3.9 | - |
II. CVE-2022-0786の公開POC
| # | POC説明 | ソースリンク | Shenlongリンク |
|---|---|---|---|
| 1 | WordPress KiviCare plugin before 2.3.9 contains a SQL injection vulnerability. The plugin does not sanitize and escape some parameters before using them in SQL statements via the ajax_post AJAX action with the get_doctor_details route. An attacker can possibly obtain sensitive information, modify data, and/or execute unauthorized administrative operations in the context of the affected site. | https://github.com/projectdiscovery/nuclei-templates/blob/main/http/cves/2022/CVE-2022-0786.yaml | POC詳細 |
AI生成POCプレミアム
公開POCは見つかりませんでした。
ログインしてAI POCを生成III. CVE-2022-0786のインテリジェンス情報
请登录查看更多情报信息。
CVE-2022-0786 厂商安全公告 (1)
Same Patch Batch · Unknown · 2022-06-13 · 46 CVEs total
| CVE-2022-1777 | Filr - Secure Document Library < 1.2.2.1 - Subscriber+ AJAX Calls | |
| CVE-2022-1781 | postTabs <= 2.10.6 - Arbitrary Settings Update via CSRF to Stored XSS | |
| CVE-2022-1788 | Change Uploaded File Permissions <= 4.0.0 - File Permission Update via CSRF | |
| CVE-2022-1792 | Quick Subscribe <= 1.7.1 - Arbitrary Settings Update via CSRF to Stored XSS | |
| CVE-2022-1793 | Private Files <= 0.40 - Protection Disabling via CSRF | |
| CVE-2022-1800 | Export any WordPress data to XML/CSV < 1.3.5 - Admin+ SQL Injection | |
| CVE-2022-1814 | WP Admin Style <= 0.1.2 - Admin+ Stored Cross-Site Scripting | |
| CVE-2022-0209 | Mitsol Social Post Feed < 1.11 - Admin+ Stored Cross-Site Scripting | |
| CVE-2022-1791 | One Click Plugin Updater <= 2.4.14 - Arbitrary Settings Update via CSRF | |
| CVE-2022-1779 | Auto Delete Posts <= 1.3.0 - Arbitrary Settings Update via CSRF | |
| CVE-2022-1780 | LaTeX for WordPress <= 3.4.10 - Arbitrary Settings Update via CSRF to Stored XSS | |
| CVE-2022-1773 | WP Athletics <= 1.1.7 - Reflected Cross-Site Scripting | |
| CVE-2022-1772 | Google Places Review < 2.0.0 - Admin+ Stored Cross Site Scripting | |
| CVE-2022-1765 | Hot Linked Image Cacher <= 1.16 - Image upload/cache abuse via CSRF | |
| CVE-2022-1764 | WP-chgFontSize <= 1.8 - Arbitrary Settings Update via CSRF to Stored XSS | |
| CVE-2022-1763 | Static Page eXtended <= 2.1 - Arbitrary Settings Update via CSRF to Stored XSS | |
| CVE-2022-1762 | iQ Block Country < 1.2.20 - Protection Bypass due to IP Spoofing | |
| CVE-2022-1761 | Peter’s Collaboration E-mails <= 2.2.0 - Arbitrary Settings Update via CSRF | |
| CVE-2022-1759 | RB Internal Links <= 2.0.16 - Stored Cross-Site Scripting via CSRF | |
| CVE-2022-1758 | Genki Pre-Publish Reminder <= 1.4.1 - Stored XSS & RCE via CSRF |
Showing 20 of 46 CVEs. View all on vendor page →
IV. 関連脆弱性
- CVE-2026-15453
KiviCare <= 4.5.1 - Authenticated (Doctor+) SQL Injection vi - CVE-2026-15072
KiviCare <= 4.5.0 - Authenticated (Doctor+) SQL Injection vi - CVE-2026-15073
KiviCare <= 4.5.0 - Authenticated (Doctor+) SQL Injection vi - CVE-2026-11990
KiviCare <= 4.4.0 - Missing Authorization to Unauthenticated - CVE-2026-2992
KiviCare <= 4.1.2 - Missing Authorization to Unauthenticated
同じベンダー: Unknown
- CVE-2026-14832
ShopSmart Loyalty for WooCommerce <= 1.0.0 - Unauthenticated - CVE-2026-13700
WooMS <= 9.14 - Unauthenticated Server-Side Request Forgery - CVE-2026-19726
Visualizer < 4.0.7 - Contributor+ Cross-User Chart Configura - CVE-2026-19728
Extra Product Options Builder for WooCommerce < 1.2.176 - Un - CVE-2026-19725
WPvivid Backup & Migration < 0.9.131 - Unauthenticated Path
同じ弱点: CWE-89
- CVE-2026-20000
itsourcecode Hospital Management System viewprescriptionreco - CVE-2026-15623
Authenticated Blind SQL Injection in Google Cloud SecOps SOA - CVE-2026-19973
itsourcecode Hospital Management System viewpaymentreport.ph - CVE-2026-19972
itsourcecode Hospital Management System viewpatient.php sql - CVE-2026-74251
Joomla Extension - phoca.cz - Unauthenticated SQL injection
V. CVE-2022-0786へのコメント
まだコメントはありません