Description (CNA)
The KiviCare WordPress plugin before 2.3.9 does not sanitise and escape some parameters before using them in SQL statements via the ajax_post AJAX action with the get_doctor_details route, leading to SQL Injections exploitable by unauthenticated users
Affected (CNA)
| Vendor / product | Versions |
|---|---|
| Unknown / KiviCare – Clinic & Patient Management System (EHR) | affected 2.3.9 before 2.3.9 |
CWE
CWE-89
References
ADP enrichment
No English description supplied.