Aramosf

An issue exists in a record-creation endpoint that accepts the record type from the request and inserts the record while permission checks are disabled. This allows any authenticated user, regardless of their operational role, to specify a privileged record type to create privileged accounts and gain full control of the site.

An authentication bypass exists in the console registration API. Unauthenticated attackers can update existing console assets by providing a known asset identifier. This allows the overwriting of push notification tokens and console metadata without ownership validation, which can lead to the redirection of notifications or the denial of delivery to legitimate consoles.

The `datapoint export` API constructs SQL for CSV crosstab by concatenating an `asset name` and `attribute name` into a `COPY` query. Because escaping single quotes does not protect double-quoted identifiers or the `$cat$` dollar-quote boundary, an authenticated user with permissions to create or rename assets and export datapoints can inject SQL metacharacters into the name. This allows the user to execute injected SELECT statements and receive the output in the ZIP/CSV response, enabling database exfiltration. In multi-tenant environments, this may expose data from other tenants if the manager's database role has access to shared tables.

An authenticated user with permissions to create or rename assets can perform a SQL injection. The issue occurs at the datapoint crosstab export endpoint, which builds PostgreSQL queries by concatenating asset display names directly into raw SQL. By manipulating the `asset name` parameter, an attacker can execute arbitrary SQL commands and exfiltrate database information via the exported CSV response.