A mass assignment issue exists in the patient portal OnsiteDocument query API. This flaw allows authenticated users to set bitwise criteria filters through request parameters, which are then inserted unquoted into the SQL WHERE clause. An attacker can perform SQL injection using parameters such as `Id BitwiseAnd` to access any database table, potentially exposing other patients' records and staff password hashes.