CVE-2024-11728 is an SQL Injection vulnerability identified in the KiviCare – Clinic & Patient Management System (EHR) WordPress plugin developed by iqonicdesign. The vulnerability arises from improper neutralization of special elements in SQL commands (CWE-89) specifically through the 'visit_type[service_id]' parameter in the tax_calculated_data AJAX action. This parameter is insufficiently escaped and the SQL queries are not properly prepared, allowing an attacker to append arbitrary SQL commands. Since the vulnerability is exploitable without authentication or user interaction, an unauthenticated remote attacker can leverage this flaw to extract sensitive information directly from the backend database. The plugin is widely used in healthcare settings to manage patient and clinic data, making the exposure of confidential health records a critical concern. The CVSS v3.1 base score is 7.5, reflecting a high severity due to network attack vector, low attack complexity, no privileges required, and no user interaction needed. The vulnerability affects all versions up to and including 3.6.4. No patches or fixes are currently linked, and no known exploits have been observed in the wild, but the potential for data leakage is substantial given the nature of the flaw.

The primary impact of CVE-2024-11728 is the unauthorized disclosure of sensitive healthcare data, including patient records and clinic management information. This can lead to privacy violations, regulatory non-compliance (e.g., HIPAA, GDPR), reputational damage, and potential financial penalties for affected organizations. Since the vulnerability allows data extraction without authentication, attackers can exploit it remotely and anonymously, increasing the risk of widespread data breaches. The integrity and availability of the system are not directly impacted, but the confidentiality breach alone is severe in healthcare contexts. Attackers could also use the extracted data for further attacks such as identity theft, fraud, or targeted phishing campaigns. The vulnerability could undermine trust in healthcare providers and disrupt clinical operations if exploited at scale.

Organizations should immediately audit their use of the KiviCare plugin and upgrade to a patched version once available. In the absence of an official patch, implement web application firewall (WAF) rules to detect and block SQL injection patterns targeting the 'visit_type[service_id]' parameter, especially in AJAX requests. Employ input validation and sanitization at the application layer to reject suspicious input. Restrict access to the AJAX endpoint by IP whitelisting or authentication where feasible. Regularly monitor logs for unusual database query patterns or repeated failed attempts. Conduct security assessments and penetration testing focused on SQL injection vectors. Backup databases securely and ensure incident response plans are ready to address potential data breaches. Engage with the vendor for timely updates and consider alternative EHR solutions if remediation is delayed.