KiviCare

KiviCare before 4.5.5 omits authorization checks from some REST endpoints. An unauthenticated attacker can retrieve the patient roster and, when a payment gateway is configured, disclose its secret key.

KiviCare before 4.5.4 does not verify that a patient-level user is entitled to the requested media file. An authenticated patient can select any WordPress media item and download it, including medical reports uploaded by other patients.

KiviCare before 4.5.4 does not verify that the requesting patient owns the appointment being modified. An authenticated KiviCare patient can select another patient's appointment and cancel or reschedule it.

KiviCare through 4.5.1 uses the searchTerm value in listing SQL without adequate escaping or preparation. Exploitation requires a KiviCare role carrying settings_view, such as Doctor or Receptionist; a standard Subscriber alone is insufficient. Such a clinic-staff user can append SQL and extract sensitive database information. The public.

KiviCare is affected by sensitive information exposure. The vulnerable path is reachable without authentication. Successful exploitation can disclose data that should not be available to the caller. The published affected range is n/a through 4.5.1.

KiviCare before 4.5.2 lets an unauthenticated POST to /wp-json/kivicare/v1/auth/register select the doctor role. AuthController::checkRegistrationPermission() returns immediately when WordPress registration is enabled and otherwise treats missing role settings as allowed; register() repeats the fail-open check, maps the supplied user_role to KCDoctor, associates the supplied clinic and can default the account to active. An attacker who supplies the required registration data and a valid clinic ID can create privileged clinic staff with access to patient, billing and clinic data. Version 4.5.2 requires doctor and receptionist public registration to be explicitly enabled.

KiviCare before 4.5.2 exposes GET routes in the kivicare/v1 namespace for /settings/listing, /settings/listing/static-data and /settings/listing/export. A clinic-staff user controls searchTerm; after esc_like(), the vulnerable code interpolates the resulting value directly into whereRaw() LIKE clauses for type or value lookups. This permits SQL injection. The exact clinic-staff subtype and extractable data or blind/error behavior are not disclosed. Version 4.5.2 parameterizes the LIKE values.

KiviCare before 4.5.2 does not verify ownership of requested patient records. An authenticated patient-level user can select another patient's records and retrieve bills, invoices and appointment details.

KiviCare – Clinic & Patient Management System (EHR) is affected by SQL injection. Exploitation requires an authenticated WordPress account. A successful request can alter database queries and expose or modify WordPress data. The published affected range is <= 4.5.0.

KiviCare – Clinic & Patient Management System (EHR) is affected by SQL injection. Exploitation requires an authenticated WordPress account. A successful request can alter database queries and expose or modify WordPress data. The published affected range is <= 4.5.0.

KiviCare – Clinic & Patient Management System (EHR) is affected by a security weakness. The vulnerable path is reachable without authentication. The resulting impact depends on how the affected component exposes the vulnerable operation. The published affected range is <= 4.4.0.

KiviCare is affected by broken access control. Exploitation requires an authenticated subscriber account. A successful request can reach data or an operation that should be restricted to another user or a more privileged role. The published affected range is n/a through 4.2.1.

KiviCare is affected by privilege escalation or authentication bypass. Exposure depends on how the affected operation is made reachable by the site. A successful request can grant permissions or access that the caller should not possess. The published affected range is <= 4.3.0.

KiviCare is affected by cross-site scripting. Exposure depends on how the affected operation is made reachable by the site. Injected script can execute in the affected site's origin when the vulnerable output is viewed. The published affected range is <= 3.6.16.

KiviCare is affected by a security weakness. Exposure depends on how the affected operation is made reachable by the site. The resulting impact depends on how the affected component exposes the vulnerable operation. The published affected range is <= 3.6.16.

KiviCare – Clinic & Patient Management System (EHR) is affected by privilege escalation or authentication bypass. The vulnerable path is reachable without authentication. A successful request can grant permissions or access that the caller should not possess.

KiviCare – Clinic & Patient Management System (EHR) is affected by privilege escalation or authentication bypass. The vulnerable path is reachable without authentication. A successful request can grant permissions or access that the caller should not possess.

KiviCare is affected by SQL injection. Exposure depends on how the affected operation is made reachable by the site. A successful request can alter database queries and expose or modify WordPress data.

KiviCare – Clinic & Patient Management System (EHR) is affected by dangerous file upload. The vulnerable path is reachable without authentication. Successful exploitation can place attacker-controlled executable content on the server and may lead to full site compromise.

KiviCare is affected by SQL injection. Exposure depends on how the affected operation is made reachable by the site. A successful request can alter database queries and expose or modify WordPress data.

KiviCare – Clinic & Patient Management System (EHR) is affected by SQL injection. Exploitation requires an authenticated WordPress account. A successful request can alter database queries and expose or modify WordPress data.

KiviCare is affected by a security weakness. Exposure depends on how the affected operation is made reachable by the site. The resulting impact depends on how the affected component exposes the vulnerable operation.