Authenticated users with read access to centers or targeted datatables can perform time-based blind SQL injection. This occurs because the application concatenates caller-supplied ordering parameters directly into the SQL ORDER BY clause, bypassing existing regex-based input validation. The affected API endpoints are '/api/v1/centers', '/api/v1/datatables/{datatable}/{apptableId}', and '/api/v1/datatables/{datatable}/{apptableId}/{datatableId}'. The vulnerable parameters are `orderBy`, `sortOrder`, and `order`.