vendor:
KiviCare Clinic & Patient Management System (EHR)
by:
Samet 'samogod' Gözet
6.1
CVSS
HIGH
SQL Injection
89
CWE
Product Name: KiviCare Clinic & Patient Management System (EHR)
Affected Version From: 3.6
Affected Version To: < 3.6.5
Patch Exists: YES
Related CWE: CVE-2024-11728
CPE: a:wordpress:kivicare_clinic_management_system:3.6.4
Platforms Tested: Ubuntu 22.04
2024
KiviCare Clinic & Patient Management System (EHR) 3.6.4 – Unauthenticated SQL Injection
An unauthenticated SQL injection vulnerability was found in KiviCare Clinic & Patient Management System (EHR) version 3.6.4. The vulnerability exists in the tax_calculated_data AJAX action, where the visit_type[service_id] parameter is insufficiently escaped, allowing attackers to execute SQL injection attacks.
Mitigation:
Update KiviCare Clinic & Patient Management System to version 3.6.5 or higher to prevent this unauthenticated SQL injection vulnerability.
