Lyethar

Authenticated users with document-note write access can perform a stored cross-site scripting attack via the 'interface/forms/eye mag/report.php' endpoint. By adding unescaped document notes, an attacker can store malicious JavaScript within a retina document note. This script executes when clinicians generate the Eye Exam patient report, which can lead to the exposure of session cookies.

An insecure direct object reference exists in the 'portal/lib/persist.php' endpoint. This allows authenticated portal patients to modify settings for other patients by altering the `setting patient` parameter in a JSON POST request to include another patient's PID, which can result in changes to portal settings such as the portal theme.