Anirudh Anand

An authenticated user with permissions to view clients can exploit a boolean-based SQL Injection in the Client Search API endpoint '/api/v1/clients'. The issue occurs because the `orderBy` and `sortOrder` parameters are concatenated into a SQL query without sufficient validation. This allows for blind boolean-based data extraction and, specifically on MySQL or MariaDB, the disclosure of arbitrary files readable by the database process through the `LOAD FILE()` function.

The issue allows an attacker to run arbitrary commands on the host machine due to a lack of restriction on access to the main context through Error objects. This can lead to Remote Code Execution. An example exploit involves evaluating a payload that manipulates the Error object's prototype and stack property to execute arbitrary code, such as printing the contents of `process.env`.